CrossCurve Bridge Exploit Drains About $3M, Rekindling Cross-Chain Risk

ccn.com發佈於 2026-02-02更新於 2026-02-02

文章摘要

Cross-chain liquidity protocol CrossCurve suffered an exploit on February 2, with estimated losses around $3 million across multiple networks. The attack involved a spoofed cross-chain message that bypassed validation, allowing the attacker to trigger unauthorized token unlocks on the destination chain. The protocol urged users to pause interactions and launched an investigation. CEO Boris Povar later published ten Ethereum addresses linked to the stolen funds, offering a 10% bounty for their return within 72 hours and threatening legal action. The incident highlights persistent vulnerabilities in cross-chain bridges, where security often conflicts with user demand for speed. Verification failures and assumptions in smart contract logic remain critical risks, as a single flaw can lead to multi-network exploits.

Key Takeaways

CrossCurve said its bridge was “under attack” on Feb. 2 and told users to pause interactions.
Defimon Alerts, linked to Decurity, estimated losses around $3 million across “several networks.”
Early reporting and security posts described a spoofed cross-chain message that bypassed validation and triggered token unlocks on the destination chain.

Cross-chain liquidity protocol CrossCurve said its bridge was exploited on Feb. 2, with security monitors estimating roughly $3 million in losses across multiple networks.

The protocol urged users to pause interactions while it investigated.

Later, CEO Boris Povar published ten Ethereum addresses he said received funds and offered a bounty of up to 10% if the assets were returned within 72 hours, warning the project would pursue legal action if no contact was made.

Try Our Recommended Crypto Exchanges

Bitget

promotions

New user rewards up to 6,200 USDT.

Coins

Claim Offer

Bitunix

promotions

Receive up to $100,000 worth of exclusive gifts for newcomers upon registration.

Coins

Claim Offer

BTCC

promotions

Get up to 10,055 USDT when you register, verify, and make the first deposit and the first trades.

Coins

Claim Offer

Explore All Offers

CrossCurve Attack Timeline

CrossCurve said on Feb. 2 that its bridge was “under attack,” involving exploitation of a vulnerability in one of the smart contracts used in its cross-chain system.

The exploit allowed an attacker to spoof a message to bypass validation and unlock tokens.

One quoted description said an attacker could call an “express” execution path on a receiver contract using a forged cross-chain message, then trigger an unlock on a portal contract.

CrossCurve has not published a full post-mortem or confirmed a final loss figure. Separate estimates clustered around $3 million.

In a follow-up post, Povar said the team identified ten Ethereum addresses tied to received funds and set a 72-hour window to return assets or make contact before escalation.

He said the project was prepared to pursue civil and criminal remedies and coordinate with industry partners to freeze assets.

CrossCurve did not immediately respond to a request for comment on the specific bug, the final loss amount, or a timeline for reopening.

A separate warning came from Curve Finance, which said users allocated to CrossCurve pools “may wish to review their positions” and consider removing votes, urging “risk-aware decisions” when interacting with third parties.

Why Spoofed Messages and Validation Assumptions Keep Winning

Bridge exploits often look like “just a smart contract bug.” The deeper pattern is verification failure.

A bridge is a promise: release assets on Chain B because something real happened on Chain A. The hard part is proving that “something real” without trusting an attacker’s message.

In general message passing, the destination contract is supposed to verify that a call was approved by the validator set by checking with the gateway (for example, via a validation function) before executing.

If a receiver contract accepts an alternate path that skips or weakens that check, a forged message can become a payout.

That’s why the “receiver side” matters as much as the messaging layer.

A protocol can route messages through reputable infrastructure and still lose funds if its own destination contract implements permissive logic, unsafe fast paths, or incorrect assumptions about upstream guarantees.

CrossCurve’s own documentation frames cross-chain risk as a “black swan” category and describes a design goal of routing through multiple independent validation protocols (“Consensus Bridge”) to reduce single points of failure.

But even multi-path designs can be undermined by a weak integration contract at the edge.

The Uncomfortable Truth: Bridge UX Wants Speed, Security Wants Paranoia

Users want bridging to feel instant: fewer clicks, less waiting, faster finality.

Security wants the opposite: more confirmations, tighter limits, and “do nothing unless you’re sure.”

Some cross-chain stacks explicitly offer speed features like “express” execution, where off-chain actors can accelerate delivery of an intended outcome.

The trade-off is that fast paths demand extra care in how authenticity is enforced, because the system is trying to move before the slowest proofs arrive.

This tension is why bridge hacks stay evergreen. Bridges concentrate liquidity, and a single verification bypass can unlock assets across multiple networks in one run.

What To Watch Next

CrossCurve has not yet released a full incident report. In most bridge incidents, the next signals that matter are:

Whether contracts remain paused and what code changes ship before any restart.
Whether the attacker returns funds, often in exchange for a bounty.
Whether stablecoin issuers, exchanges, or analytics firms flag and freeze related addresses.
Whether independent security teams publish a corroborated root-cause analysis.

For now, the takeaway is familiar and still useful: cross-chain bridges remain one of crypto’s most repeatable failure points, because “truth across chains” is a hard engineering problem with real money behind every assumption.

This is a developing story and will be updated.

Recommended Secure Partners

Safest Exchanges Best Safest (Most Secure) Crypto Exchanges? Check Out These Exchanges
Secure Crypto Wallets Crypto Wallets Reviews and Ranked
Bet Anonymously Check Out Our Recommended No KYC Casinos

你可能也喜歡

10 亿回购难阻 HYPE 下跌，核心成员与 Multicoin 在悄悄卖币？

自2025年12月HYPE团队代币开始分配至2026年7月底，核心成员及相关钱包累计收到约493万枚HYPE（占总供应量0.493%），其中约119万枚在公开市场出售套现3250万美元，另有314万枚转入场外交易平台。同期，项目“援助基金”利用协议收入进行了更大力度的回购，累计回购约980万枚，花费约3.64亿美元，回购速度超过团队出售速度的两倍。尽管有巨额回购支撑，HYPE币价自2026年7月下旬的70美元高点跌至约52.4美元。分析认为，币价回调不能简单归因于团队卖币。重要影响因素包括：主要风投机构（如Multicoin Capital、a16z）的减持行为，它们自7月起出现大规模解质押并向交易所转移代币；同时，HYPE现货ETF自7月初以来持续出现日均约100万美元的净流出，与之前月份的强劲净流入形成反差。当市场情绪转冷、交易量萎缩时，协议自身的回购资金也会减少，削弱买盘支撑。

marsbit4 分鐘前

marsbit4 分鐘前

WEEX API Fast Connect：10秒内将每次登录转化为实盘交易者

WEEX宣布推出API快速连接（API Fast Connect），一种一键式OAuth授权系统。该系统允许用户无需手动处理API密钥即可关联其WEEX账户。该解决方案专为WEEX经纪商合作伙伴设计，旨在通过无缝的一键体验取代传统复杂的技术接入流程，从而在合作伙伴平台上实现更快的用户转化和更强的长期留存。 **核心要点：** * **功能：** 类似“使用Google登录”的一键授权系统，让用户无需创建或管理API密钥即可将其WEEX账户连接到第三方平台。 * **解决问题：** 手动API密钥设置是阻碍潜在用户成为活跃交易者的最大障碍。快速连接彻底消除了这一步骤。 * **获益：** 实现无摩擦转化，降低用户流失，提高留存率，使用户能在数秒内（而非数分钟）从登录进入实盘交易。 * **目标用户：** AI信号平台、量化策略工具、交易机器人以及任何目前需要用户手动配置API访问的WEEX经纪商合作伙伴。 **运作流程：** 1. 用户在合作平台点击“使用WEEX登录”。 2. 系统重定向至官方WEEX授权页面进行验证。 3. 用户确认API密钥的授权范围（默认为交易和读取权限）。 4. 确认后，系统在后台生成API密钥并通过加密通道直接绑定至合作平台。 **优势对比：** 与传统手动API密钥方式相比，快速连接在用户体验（一键操作 vs 手动碎片化流程）、权限管理（预设防错 vs 易出错）、密钥安全（后端加密，用户不接触密钥 vs 前端暴露高风险）和连接速度（即时绑定 vs 手动复制粘贴）方面均有显著提升。 API快速连接是WEEX经纪商工具包的核心组件之一，旨在帮助合作伙伴将感兴趣的用户迅速转化为实际交易者。

TheNewsCrypto10 分鐘前

TheNewsCrypto10 分鐘前

XRP Ledger v3.3.0 版本更新聚焦五项修正案

XRP Ledger即将发布v3.3.0版本，聚焦五项核心升级。本次升级包含五个待激活的修正案：保密MPT、批量处理、权限委托、赞助费用与储备金、动态MPT。这些功能旨在增强账本在代币化资产、费用抽象化、权限管理和批量操作等方面的灵活性，为机构级应用提供更完善的基础设施。特别值得注意的是，赞助费用机制有望显著改善用户体验，允许第三方为用户支付网络费用，降低新用户的使用门槛。同时，保密MPT和动态MPT的引入，旨在满足金融机构对资产隐私、合规控制和灵活行为规则的需求。批量交易和权限委托则能提升应用的操作效率和便捷性。需明确的是，代码发布并不等同于功能即时生效。所有修正案均需获得超过80%的验证者共识支持后才能正式激活。因此，本次升级为开发者铺平了道路，但其实际影响将取决于验证者的投票结果以及后续生态的采用情况。总体而言，v3.3.0版本明确了XRPL在增强实用性和拓展代币化应用方面的技术路线图。

bitcoinist25 分鐘前

bitcoinist25 分鐘前

华尔街早报：月底V反但纳指创下12年来最差7月，资金加速向云巨头集中

上周五美股三大指数V型反弹，但整个7月表现疲软，标普500基本持平，纳指下跌3.2%，创2004年以来最差7月。原油市场因特朗普取消对伊军事打击及OPEC+计划增产而大幅震荡，WTI原油周一开盘暴跌超8%。黄金7月微涨0.91%，在4050美元/盎司附近震荡，分析认为其正处于筑底阶段。美日罕见联手干预汇市，美元兑日元跌破156关口；10年期美债收益率7月飙升超30个基点，创2005年以来最大单月涨幅。科技股方面，市场资金正从存储、半导体等板块撤出，加速流向云巨头。上周，亚马逊、微软、谷歌和Meta市值合计增加近1.5万亿美元。亚马逊因AWS业绩超预期暴涨15.32%；微软延续涨势；谷歌收复财报后失地；Meta终结十一连跌。苹果则因供应链问题及展望偏软重挫7.35%。存储板块普遍回调，而光通信板块上涨。本周市场关注重点包括：伯克希尔·哈撒韦财报；Palantir、AMD、SpaceX等公司业绩；SpaceX大规模限售股解禁；以及美国7月非农就业报告和中国7月经济数据。

marsbit49 分鐘前

marsbit49 分鐘前

Rubin Ultra大减配，英伟达也扛不住内存涨价了？

知名投研机构SemiAnalysis近日报告指出，英伟达已向主要客户预览了其顶级AI芯片Rubin Ultra的最新规格，但相比此前预期出现显著降配。核心变化包括：算力峰值保持与普通版Rubin相同的35 PFLOPs；显存容量降至8层堆叠的192GB，甚至低于普通版的288GB；显存带宽仅微升1TB/s；芯片功耗反而略有提高。Rubin Ultra的主要升级方向转向“扩展互联规模”，支持通过NVLink将最多576张GPU互联成统一计算域，远高于普通版的72张。报告分析认为，此次调整主要源于HBM（高带宽内存）价格持续快速上涨。以HBM3为例，其价格已从2025年二季度的低点180-220美元，飙升至目前约700-850美元。HBM成本飙升使得Rubin Ultra单机架的物料成本一度从约660万美元升至800万美元。英伟达因此重新评估设计，通过减少昂贵的HBM配置（成本占比从近40%降至28%），将资源更多投入互联能力等方向，优化整体成本结构。此消息引发市场对HBM需求见顶的担忧。受冲击影响，韩国存储股开盘大跌，SK海力士、三星股价均下挫约8%。市场解读认为，若英伟达此举成为趋势，意味着AI芯片厂商可能开始通过优化设计来降低对高容量HBM的依赖，这或将限制存储厂商未来的提价空间，标志着AI基础设施的“堆料涨价”时代可能接近尾声。

Odaily星球日报1 小時前

Odaily星球日报1 小時前

交易

現貨

CrossCurve Bridge Exploit Drains About $3M, Rekindling Cross-Chain Risk

文章摘要

Bitget

Bitunix

BTCC

CrossCurve Attack Timeline

Why Spoofed Messages and Validation Assumptions Keep Winning

The Uncomfortable Truth: Bridge UX Wants Speed, Security Wants Paranoia

What To Watch Next

相關問答

你可能也喜歡

10 亿回购难阻 HYPE 下跌，核心成员与 Multicoin 在悄悄卖币？

WEEX API Fast Connect：10秒内将每次登录转化为实盘交易者

XRP Ledger v3.3.0 版本更新聚焦五项修正案

华尔街早报：月底V反但纳指创下12年来最差7月，资金加速向云巨头集中

Rubin Ultra大减配，英伟达也扛不住内存涨价了？

交易

熱門分類

熱門標籤