CrossCurve hack — January 2026

CrossCurve, the cross-chain routing and bridging protocol built by the EYWA team and counting Curve Finance founder Michael Egorov among its investors, was drained of roughly $3 million on 31 January 2026. The team confirmed the attack publicly in posts on 1 and 2 February.

The flaw was a missing authorisation check in CrossCurve's ReceiverAxelar contract. Its expressExecute function could be called by any address carrying a fabricated cross-chain message, and because the contract did not validate that message against the Axelar gateway, the forged call triggered releases from the PortalV2 contract holding bridged assets. Defimon Alerts flagged the drain as the PortalV2 balance fell from about $3 million to near zero. Losses were spread across networks, with the largest amounts on Ethereum, around $1.3 million, and Arbitrum, around $1.28 million, and smaller amounts on Optimism, Base, Mantle, Kava, Frax, Celo and Blast. BlockSec put the total slightly lower, at about $2.76 million, against the roughly $3 million figure used in most reporting.

CrossCurve told users to pause all interactions while it investigated, then identified ten receiving addresses and invoked its SafeHarbor white-hat policy, offering a 10 percent bounty and a 72-hour window for voluntary return. It said at first that it did not believe the taking was intentional, and warned that failure to return the funds would be followed by criminal referrals, civil litigation, coordination with exchanges and stablecoin issuers to freeze assets, and publication of the wallets. Curve Finance advised holders with votes allocated to EYWA-related pools to review their positions. No return, recovery or full post-mortem was publicly confirmed afterwards.