- Trending
- Comments
- Latest
CrossCurve, a cross-chain bridge backed by Curve Finance founder Michael Egorov, lost approximately $3 million on Monday after attackers exploited a vulnerability allowing them to spoof cross-chain messages and bypass security checks.
The protocol has offered a 10% bounty for return of the funds and warned users to halt all platform interactions.
According to CrossCurve, the Crosscurve smart contract exploit originated from a vulnerability in one of its smart contract components that allowed attackers to manipulate cross-chain messaging.
“Our bridge is currently under attack,” CrossCurve said in a statement posted on X.
The protocol said the flaw caused some user addresses to receive token funds that were “wrongfully taken” from other users. CrossCurve identified 10 addresses involved in the exploit and appealed directly to those users for cooperation.
“We do not believe this was intentional on your part, and there is no indication of malicious intent. We hope for your cooperation in returning the funds,” the protocol said.
Blockchain security monitoring account Defimon Alerts later provided technical details, stating that the Crosscurve smart contract exploit was linked to the project’s ReceiverAxelar smart contract.
According to the alert, attackers were able to spoof cross-chain messages and bypass gateway validation checks, leading to unauthorized token unlocks on the PortalV2 contract.
The mechanics of the Crosscurve smart contract exploit highlight a recurring risk in bridge design, where failures in message verification can cascade into large-scale fund losses.
In response to the Crosscurve smart contract exploit, the protocol activated its Safe Harbor Responsible Disclosure Policy and offered incentives for the recovery of stolen assets.
“This makes you eligible to keep up to 10% if the remainder is returned,” CrossCurve said in its Safe Harbor notice.
The project imposed a 72-hour deadline for communication from the attacker or any intermediary seeking to negotiate a return.
If the funds are not recovered within that timeframe, CrossCurve said it will escalate the matter through formal legal channels.
The escalation plan includes cooperation with major centralized exchanges such as Coinbase and Binance, as well as stablecoin issuers and law enforcement agencies.
CrossCurve also said it is working with blockchain analytics firms including Chainalysis, TRM Labs, and Elliptic to trace fund movements linked to the Crosscurve smart contract exploit.
Separately, Curve Finance issued an advisory warning that users who allocated governance votes to CrossCurve-related liquidity pools “may wish to review their positions and consider removing those votes,” signaling broader ecosystem caution.
The Crosscurve smart contract exploit has drawn comparisons to earlier bridge failures, including the 2022 Nomad bridge hack that resulted in losses of approximately $190 million.
Such incidents have reinforced concerns that cross-chain bridges remain one of the weakest links in DeFi’s security architecture.
Despite repeated attacks, many protocols continue to rely on complex messaging systems that can be difficult to audit comprehensively.
CrossCurve raised $7 million from venture capital firms in 2023 and positioned itself as a key interoperability layer within the Curve ecosystem.
Its backing by prominent industry figures has intensified scrutiny over whether existing auditing and testing practices were sufficient to prevent the exploit.
Andrew Morfill, Chief Information Security Officer at crypto custody firm Komainu, said stronger industry standards are needed as DeFi matures.
“In terms of prevention, an industry set of standard smart contract templates that are known to be secure, smart contract auditing and secure software development lifecycles would be steps in the right direction,” Morfill said.
“As the market matures, securely developed and updated protocols with real utility will provide the credibility and security assurance investors are looking for,” he added.
For investors, the Crosscurve smart contract exploit is another reminder that cross-chain protocols carry elevated risk, even when backed by established ecosystems and venture funding.
While recovery efforts may reduce immediate losses, the incident is likely to intensify calls for stricter audits, standardized bridge designs, and clearer accountability frameworks.
As investigations continue, the outcome of the Crosscurve smart contract exploit particularly whether stolen funds are recovered may influence how DeFi projects balance innovation with security in an increasingly hostile threat environment.
