CrossCurve Bridge Exploit Drains About $3M, Rekindling Cross-Chain Risk

ccn.com发布于2026-02-02更新于2026-02-02

文章摘要

Cross-chain liquidity protocol CrossCurve suffered an exploit on February 2, with estimated losses around $3 million across multiple networks. The attack involved a spoofed cross-chain message that bypassed validation, allowing the attacker to trigger unauthorized token unlocks on the destination chain. The protocol urged users to pause interactions and launched an investigation. CEO Boris Povar later published ten Ethereum addresses linked to the stolen funds, offering a 10% bounty for their return within 72 hours and threatening legal action. The incident highlights persistent vulnerabilities in cross-chain bridges, where security often conflicts with user demand for speed. Verification failures and assumptions in smart contract logic remain critical risks, as a single flaw can lead to multi-network exploits.

Key Takeaways

CrossCurve said its bridge was “under attack” on Feb. 2 and told users to pause interactions.
Defimon Alerts, linked to Decurity, estimated losses around $3 million across “several networks.”
Early reporting and security posts described a spoofed cross-chain message that bypassed validation and triggered token unlocks on the destination chain.

Cross-chain liquidity protocol CrossCurve said its bridge was exploited on Feb. 2, with security monitors estimating roughly $3 million in losses across multiple networks.

The protocol urged users to pause interactions while it investigated.

Later, CEO Boris Povar published ten Ethereum addresses he said received funds and offered a bounty of up to 10% if the assets were returned within 72 hours, warning the project would pursue legal action if no contact was made.

Try Our Recommended Crypto Exchanges

Bitget

promotions

New user rewards up to 6,200 USDT.

Coins

Claim Offer

Bitunix

promotions

Receive up to $100,000 worth of exclusive gifts for newcomers upon registration.

Coins

Claim Offer

BTCC

promotions

Get up to 10,055 USDT when you register, verify, and make the first deposit and the first trades.

Coins

Claim Offer

Explore All Offers

CrossCurve Attack Timeline

CrossCurve said on Feb. 2 that its bridge was “under attack,” involving exploitation of a vulnerability in one of the smart contracts used in its cross-chain system.

The exploit allowed an attacker to spoof a message to bypass validation and unlock tokens.

One quoted description said an attacker could call an “express” execution path on a receiver contract using a forged cross-chain message, then trigger an unlock on a portal contract.

CrossCurve has not published a full post-mortem or confirmed a final loss figure. Separate estimates clustered around $3 million.

In a follow-up post, Povar said the team identified ten Ethereum addresses tied to received funds and set a 72-hour window to return assets or make contact before escalation.

He said the project was prepared to pursue civil and criminal remedies and coordinate with industry partners to freeze assets.

CrossCurve did not immediately respond to a request for comment on the specific bug, the final loss amount, or a timeline for reopening.

A separate warning came from Curve Finance, which said users allocated to CrossCurve pools “may wish to review their positions” and consider removing votes, urging “risk-aware decisions” when interacting with third parties.

Why Spoofed Messages and Validation Assumptions Keep Winning

Bridge exploits often look like “just a smart contract bug.” The deeper pattern is verification failure.

A bridge is a promise: release assets on Chain B because something real happened on Chain A. The hard part is proving that “something real” without trusting an attacker’s message.

In general message passing, the destination contract is supposed to verify that a call was approved by the validator set by checking with the gateway (for example, via a validation function) before executing.

If a receiver contract accepts an alternate path that skips or weakens that check, a forged message can become a payout.

That’s why the “receiver side” matters as much as the messaging layer.

A protocol can route messages through reputable infrastructure and still lose funds if its own destination contract implements permissive logic, unsafe fast paths, or incorrect assumptions about upstream guarantees.

CrossCurve’s own documentation frames cross-chain risk as a “black swan” category and describes a design goal of routing through multiple independent validation protocols (“Consensus Bridge”) to reduce single points of failure.

But even multi-path designs can be undermined by a weak integration contract at the edge.

The Uncomfortable Truth: Bridge UX Wants Speed, Security Wants Paranoia

Users want bridging to feel instant: fewer clicks, less waiting, faster finality.

Security wants the opposite: more confirmations, tighter limits, and “do nothing unless you’re sure.”

Some cross-chain stacks explicitly offer speed features like “express” execution, where off-chain actors can accelerate delivery of an intended outcome.

The trade-off is that fast paths demand extra care in how authenticity is enforced, because the system is trying to move before the slowest proofs arrive.

This tension is why bridge hacks stay evergreen. Bridges concentrate liquidity, and a single verification bypass can unlock assets across multiple networks in one run.

What To Watch Next

CrossCurve has not yet released a full incident report. In most bridge incidents, the next signals that matter are:

Whether contracts remain paused and what code changes ship before any restart.
Whether the attacker returns funds, often in exchange for a bounty.
Whether stablecoin issuers, exchanges, or analytics firms flag and freeze related addresses.
Whether independent security teams publish a corroborated root-cause analysis.

For now, the takeaway is familiar and still useful: cross-chain bridges remain one of crypto’s most repeatable failure points, because “truth across chains” is a hard engineering problem with real money behind every assumption.

This is a developing story and will be updated.

Recommended Secure Partners

Safest Exchanges Best Safest (Most Secure) Crypto Exchanges? Check Out These Exchanges
Secure Crypto Wallets Crypto Wallets Reviews and Ranked
Bet Anonymously Check Out Our Recommended No KYC Casinos

你可能也喜欢

比特币短期调整持续，HYPE临近关键支撑｜特邀分析

比特币本周持续日线级别b浪调整，价格已下探至62,268美元。关键支撑位于60,900~61,500美元区域，若获得支撑且不跌破前低57,820美元，则可能结束调整并开启c浪反弹，目标看向67,300美元附近。当前市场结构转为空头主导，中线空头仓位约40%。若币价有效站稳63,600美元，可考虑将空头仓位降至20%以内。短线操作上，提出了两套方案：站稳63,600美元上方可试探性做多；或在前低57,820美元上方出现企稳信号时轻仓试多，均需严格设置止损。 HYPE方面，日线级别正处于C浪调整末端，价格已运行至50~52美元关键支撑区，技术指标显示超卖，存在短线修复可能。本周需密切关注该区域支撑力度，若出现止跌企稳信号，可考虑轻仓试多，仓位控制在20%以内，并严守止损纪律。文章同时对上周交易进行了复盘，比特币短线空单操作实现约2.58%的收益。最后强调，所有分析与策略均需动态调整，不构成投资建议，市场有风险，投资需谨慎。

Odaily星球日报3分钟前

Odaily星球日报3分钟前

AXT股票盘后暴涨23.5%，创纪录业绩与长期供应协议引爆双重催化剂

综合来看，历史性的业绩超预期、毛利率从一年前的8.2%大幅扩张至45.0%的创纪录水平，以及锁定多年营收可见性的8,700万美元长期供应协议，三重利好共同形成完美风暴，推动股价大幅走高。这也进一步强化了市场对AXT的投资逻辑——公司已进入新的增长阶段，其背后是人工智能驱动的磷化铟衬底需求持续扩张。

投研日志14分钟前

投研日志14分钟前

Coldcard攻击升级：第四波攻击使比特币失窃金额突破9000万美元

冷钱包安全事件升级：第四波攻击导致比特币被盗金额超过9000万美元最初只是警告的漏洞，现已演变为比特币历史上最严重的硬件钱包安全事件之一。过去三天，运行存在漏洞固件的Coldcard设备遭到攻击者利用关键缺陷清空资产。受影响设备生成的种子短语熵值低于预期，导致其可被预测和利用。此次事件已造成约9000万美元的损失，涉及超过4500个钱包，在多轮协同攻击中被盗比特币超过1367枚。 **第四波攻击仍在持续** Galaxy Research研究主管Alex Thorn指出很可能存在第四波攻击。在区块960,778至960,792大约2.5小时内的模式显示，218笔交易涉及462个受害地址，216个新的目标地址收到了388.92枚比特币。清扫活动速率达到正常水平的约45倍，每区块13.8次清扫，而基线为0.3次。所有交易均显示没有早于Coldcard固件边界之前的输入，拓扑结构为1:1（每个受害者对应一个新目的地），没有收集漏斗。在排除6个有先前交易历史的地址后，第四波攻击的核心数据为709个地址和448.73枚比特币。部分被盗资金已转移至第二跳地址，而一些交易仍带有RBF选择加入信号，这可能为受害者提供了短暂的响应窗口。 **Coldcard的应对措施** Coldcard背后的加拿大公司Coinkite已确认该漏洞并迅速采取行动：销毁了其设施内所有剩余受影响固件设备、暂停发货，并直接联系已收到受影响订单的用户提供迁移步骤。目前所有受影响型号均已提供修补固件，但该修复仅保护新生成的种子短语。在漏洞固件上创建的任何种子即使更新后仍面临风险，用户必须生成新钱包并立即转移所有资金。Satscard、Opendime和Tapsigner因使用不同代码库未受影响。对于需要立即替代方案的用户，Coldcard建议可临时使用Bitkey、Ledger、Trezor、Jade和Bitbox。公司还要求受影响用户保留设备以支持未来可能的恢复工作。受影响的固件版本为Coldcard Mk3的v4.0.1至v5.0.3。此次大规模漏洞事件严重动摇了市场对比特币最受信任的冷存储解决方案之一的信心，也对硬件钱包安全性提出了广泛警示。

TheNewsCrypto23分钟前

TheNewsCrypto23分钟前

AXT 2026 年第二季度业绩超出预期，盘后股价飙升

AXT公布了创纪录的季度营收，达到4760万美元，比第一季度增长77%，比上年同期增长164%。

投研日志41分钟前

投研日志41分钟前

中国科技产业，正在批量越过“可见线”

最近，中国科技产业多个领域接连进入全球视野，如大模型Kimi K3和DeepSeek-V4-Flash发布、机器人设备受国际关注、辉瑞与信达生物达成创新药合作等。这标志着中国产业能力正集中越过“可见线”——即从内部积累进入全球市场验证的阶段。回顾过去，中国出口主力从服装家电“老三样”，到新能源汽车等“新三样”，再到如今人工智能、机器人、创新药“新新三样”，产业迭代周期明显缩短。越过“可见线”的产业通常具备四大特征：形成规模、优势突出、增长加速、带动产业链。与以往不同，当前中国产业不再只是跟进成熟市场，而是通过降低门槛、开放生态，主动参与定义新产品和新需求。这种变化源于中国产业体系从“完整”走向“稠密”：不同领域共享技术、人才与供应链，形成能力迁移。例如，新能源汽车积累的技术向机器人产业延伸，算力需求带动芯片、存储、光通信等整条产业链。产业与研发的距离缩短，真实应用反馈加速创新，规模化成为创新的一部分。越过“可见线”意味着中国产业的竞争焦点，从“做出产品”延伸至构建包含专利、标准、生态的持续价值系统。未来，中国需在开放中筑牢产业护城河，通过开源、协同研发扩大生态，推动技术迭代与广泛应用。 “十五五”规划已布局战略性新兴产业与未来产业，持续将新产业推向市场检验。一批又一批产业越过“可见线”，不仅体现单点突破，更意味着中国正形成持续产生新产业的能力。

marsbit48分钟前

marsbit48分钟前

交易

现货

CrossCurve Bridge Exploit Drains About $3M, Rekindling Cross-Chain Risk

文章摘要

Bitget

Bitunix

BTCC

CrossCurve Attack Timeline

Why Spoofed Messages and Validation Assumptions Keep Winning

The Uncomfortable Truth: Bridge UX Wants Speed, Security Wants Paranoia

What To Watch Next

相关问答

你可能也喜欢

比特币短期调整持续，HYPE临近关键支撑｜特邀分析

AXT股票盘后暴涨23.5%，创纪录业绩与长期供应协议引爆双重催化剂

Coldcard攻击升级：第四波攻击使比特币失窃金额突破9000万美元

AXT 2026 年第二季度业绩超出预期，盘后股价飙升

中国科技产业，正在批量越过“可见线”

交易

热门分类

热门标签