CrossCurve Bridge Exploit Drains About $3M, Rekindling Cross-Chain Risk

ccn.com發佈於 2026-02-02更新於 2026-02-02

文章摘要

Cross-chain liquidity protocol CrossCurve suffered an exploit on February 2, with estimated losses around $3 million across multiple networks. The attack involved a spoofed cross-chain message that bypassed validation, allowing the attacker to trigger unauthorized token unlocks on the destination chain. The protocol urged users to pause interactions and launched an investigation. CEO Boris Povar later published ten Ethereum addresses linked to the stolen funds, offering a 10% bounty for their return within 72 hours and threatening legal action. The incident highlights persistent vulnerabilities in cross-chain bridges, where security often conflicts with user demand for speed. Verification failures and assumptions in smart contract logic remain critical risks, as a single flaw can lead to multi-network exploits.

Key Takeaways

CrossCurve said its bridge was “under attack” on Feb. 2 and told users to pause interactions.
Defimon Alerts, linked to Decurity, estimated losses around $3 million across “several networks.”
Early reporting and security posts described a spoofed cross-chain message that bypassed validation and triggered token unlocks on the destination chain.

Cross-chain liquidity protocol CrossCurve said its bridge was exploited on Feb. 2, with security monitors estimating roughly $3 million in losses across multiple networks.

The protocol urged users to pause interactions while it investigated.

Later, CEO Boris Povar published ten Ethereum addresses he said received funds and offered a bounty of up to 10% if the assets were returned within 72 hours, warning the project would pursue legal action if no contact was made.

Try Our Recommended Crypto Exchanges

Bitget

promotions

New user rewards up to 6,200 USDT.

Coins

Claim Offer

Bitunix

promotions

Receive up to $100,000 worth of exclusive gifts for newcomers upon registration.

Coins

Claim Offer

BTCC

promotions

Get up to 10,055 USDT when you register, verify, and make the first deposit and the first trades.

Coins

Claim Offer

Explore All Offers

CrossCurve Attack Timeline

CrossCurve said on Feb. 2 that its bridge was “under attack,” involving exploitation of a vulnerability in one of the smart contracts used in its cross-chain system.

The exploit allowed an attacker to spoof a message to bypass validation and unlock tokens.

One quoted description said an attacker could call an “express” execution path on a receiver contract using a forged cross-chain message, then trigger an unlock on a portal contract.

CrossCurve has not published a full post-mortem or confirmed a final loss figure. Separate estimates clustered around $3 million.

In a follow-up post, Povar said the team identified ten Ethereum addresses tied to received funds and set a 72-hour window to return assets or make contact before escalation.

He said the project was prepared to pursue civil and criminal remedies and coordinate with industry partners to freeze assets.

CrossCurve did not immediately respond to a request for comment on the specific bug, the final loss amount, or a timeline for reopening.

A separate warning came from Curve Finance, which said users allocated to CrossCurve pools “may wish to review their positions” and consider removing votes, urging “risk-aware decisions” when interacting with third parties.

Why Spoofed Messages and Validation Assumptions Keep Winning

Bridge exploits often look like “just a smart contract bug.” The deeper pattern is verification failure.

A bridge is a promise: release assets on Chain B because something real happened on Chain A. The hard part is proving that “something real” without trusting an attacker’s message.

In general message passing, the destination contract is supposed to verify that a call was approved by the validator set by checking with the gateway (for example, via a validation function) before executing.

If a receiver contract accepts an alternate path that skips or weakens that check, a forged message can become a payout.

That’s why the “receiver side” matters as much as the messaging layer.

A protocol can route messages through reputable infrastructure and still lose funds if its own destination contract implements permissive logic, unsafe fast paths, or incorrect assumptions about upstream guarantees.

CrossCurve’s own documentation frames cross-chain risk as a “black swan” category and describes a design goal of routing through multiple independent validation protocols (“Consensus Bridge”) to reduce single points of failure.

But even multi-path designs can be undermined by a weak integration contract at the edge.

The Uncomfortable Truth: Bridge UX Wants Speed, Security Wants Paranoia

Users want bridging to feel instant: fewer clicks, less waiting, faster finality.

Security wants the opposite: more confirmations, tighter limits, and “do nothing unless you’re sure.”

Some cross-chain stacks explicitly offer speed features like “express” execution, where off-chain actors can accelerate delivery of an intended outcome.

The trade-off is that fast paths demand extra care in how authenticity is enforced, because the system is trying to move before the slowest proofs arrive.

This tension is why bridge hacks stay evergreen. Bridges concentrate liquidity, and a single verification bypass can unlock assets across multiple networks in one run.

What To Watch Next

CrossCurve has not yet released a full incident report. In most bridge incidents, the next signals that matter are:

Whether contracts remain paused and what code changes ship before any restart.
Whether the attacker returns funds, often in exchange for a bounty.
Whether stablecoin issuers, exchanges, or analytics firms flag and freeze related addresses.
Whether independent security teams publish a corroborated root-cause analysis.

For now, the takeaway is familiar and still useful: cross-chain bridges remain one of crypto’s most repeatable failure points, because “truth across chains” is a hard engineering problem with real money behind every assumption.

This is a developing story and will be updated.

Recommended Secure Partners

Safest Exchanges Best Safest (Most Secure) Crypto Exchanges? Check Out These Exchanges
Secure Crypto Wallets Crypto Wallets Reviews and Ranked
Bet Anonymously Check Out Our Recommended No KYC Casinos

你可能也喜歡

300万粉女神全是AI合成，伪造孤儿院，跨国「假慈善」一夜塌房

澳洲网红Lily Jay（本名Lily Jay Hinson）被曝利用AI技术伪造跨国慈善活动，骗取公众捐款。其运营的“Lily Jay基金会”在社交媒体拥有近300万粉丝，发布大量在尼泊尔、加沙、乌干达等地行善的视频，包括建造孤儿院、清真寺和发放物资。调查发现，多个关键视频内容为AI生成。例如，乌干达孤儿院开张视频中的人物、儿童及横幅均为伪造，图像中出现AI典型的拼写错误。所谓的孤儿院在当地并无合法注册。基金会官网曾隐晦声明自己并非慈善机构。此外，其宣称获得的人道主义奖项及领奖照片也被检测出AI生成水印。在加沙的“面包房”项目无法被当地机构证实。基金会的运营架构也存在疑点，个人账号与基金会账号分处不同国家，且Lily Jay本人并非基金会董事。事件曝光后，相关网页对澳大利亚访问者隐藏了捐款按钮和免责声明，但海外通道仍开放。专家指出，此类骗局利用人们行善的愿望和AI制造的逼真幻象，规避正规慈善的财务透明要求，严重透支社会信任。报道警示，随着AI伪造技术发展，公众需对过于完美的慈善叙事保持警惕，多方核实信息真伪。

marsbit9 分鐘前

marsbit9 分鐘前

L2「再校准」：当 L1 变成自身的 Rollup，以太坊的终局是什么？

以太坊社区正重新审视L1与L2的关系。过去，L2主要作为扩容手段提供廉价交易空间，但随着以太坊主网自身通过提高Gas Limit、推进无状态化和zkEVM验证等方式提升能力，L2的定位需从“单纯扩容”转向提供L1难以满足的差异化需求，如特定应用优化、隐私功能和灵活治理模型。互操作性成为关键挑战。流动性、账户状态和应用体验因L2增多而碎片化。解决方案包括开放意图框架和以太坊互操作层，旨在让跨链交易体验接近单链，同时通过缩短最终确定性时间（从分钟级到秒级）来提升跨链应用效率。更具颠覆性的观点是，随着证明系统（如zkEVM）进入主网验证流程，L1未来可能采用类似Rollup的架构——由部分节点执行交易并生成证明，其他验证者验证证明而非重复执行。这将模糊L1与L2的传统边界，使Rollup成为一种更通用的执行验证架构。最终，L2的演进方向或将成为一组在安全、结算和流动性方面与以太坊建立不同关系的执行环境，它们共享核心安全基础，但提供多样化的功能与性能。以太坊的目标是在保持扩容成果的同时，重新整合用户体验，让分散的系统仍能感觉像“一条链”。

marsbit12 分鐘前

marsbit12 分鐘前

灰度投资公司向SEC提交首个Worldcoin现货ETF申请，股票代码GWLD

灰度投资公司向美国证券交易委员会（SEC）提交了Form S-1注册声明，计划推出全球首只Worldcoin现货ETF，拟以代码GWLD在纳斯达克上市。该信托成立于7月10日，旨在为美国投资者提供受监管的WLD投资渠道，因其公民无法直接获得Worldcoin用户赠款。申请提交时，WLD价格正处历史低位（2026年5月曾跌至0.2279美元），消息宣布后随即上涨超8%，交易量大增。然而，申请文件也揭示了代币经济学风险：前100名地址持有约90%的流通供应，且内部人员和开发者的代币将持续解锁至2028年，可能造成持续抛压。 Worldcoin因使用眼球扫描生物识别技术而在多国面临数据监管审查。尽管上市可能推迟至2026年底，灰度仍在积极拓展其加密投资产品线，试图在ETF市场竞争加剧前抢占先机。目前SEC是否会批准该产品仍不确定。

TheNewsCrypto24 分鐘前

TheNewsCrypto24 分鐘前

金钱的永恒碎片：三方支付没有第一性

本文讨论了第三方支付行业的现状与未来，尤其聚焦于Stripe和PayPal的动态。Stripe曾因未在疫情估值高峰时上市而错失良机，现正试图通过收购PayPal来弥补其C端业务的不足，并探索稳定币、Agent经济等新叙事以提升估值。然而，支付行业高度碎片化且依附于银行体系的特性，使得任何单一企业都难以通吃市场。作者指出，稳定币和Agent驱动的支付可能是未来的趋势，但目前仍面临应用场景有限、依赖传统金融入口等问题。Stripe和Circle等公司正布局公链和清算网络，试图在稳定币流转效率中寻找新的盈利点，部分摆脱对商业银行的依赖。最终，支付行业的竞争被视为一场没有终点的“堑壕战”，地域和行业碎片化格局难以被彻底颠覆，技术创新更多是在既有体系内寻求局部优化和效率提升。

marsbit34 分鐘前

marsbit34 分鐘前

加密法案 Clarity 闯关记：美国两党妥协之路布满荆棘

美国国会两党正推进加密市场结构立法“Clarity法案”，但其立法进程充满挑战。今年1月，因Coinbase CEO的干预，参议院银行委员会已达成的两党协议被推翻。四个月后，法案凭借两党在“收益”问题上的妥协重回议程，但“伦理条款”成为民主党的核心诉求。5月委员会投票时，仅两位民主党参议员支持，并明确后续支持取决于伦理问题的解决。最终该法案在参议院农业委员会以党派投票通过，未获任何民主党人支持。 7月，共和党人急于推动全体投票，但伦理条款争议扩大，部分共和党人也转向支持大银行立场，执法机构则对开发者保护条款表示反对。非法金融和消费者保护仍是焦点，两位资深参议员分别强调了法案的执法工具价值和谨慎立法的必要性。目前，两党虽认同需要市场结构立法，但在关键条款上难以妥协。近期有议员与白宫会面讨论伦理条款，但民主党人对其版本不满。行业期待两院委员会的和解文本，但其能否获得足够两党支持仍存疑。可能的路径包括：8月休会前进行象征性投票；争取在2026年前完成立法；或达成包含伦理等条款的妥协框架。尽管障碍重重，加密行业仍需通过传统的逐票争取方式，在漫长立法过程中寻求突破。

Foresight News1 小時前

Foresight News1 小時前

交易

現貨

CrossCurve Bridge Exploit Drains About $3M, Rekindling Cross-Chain Risk

文章摘要

Bitget

Bitunix

BTCC

CrossCurve Attack Timeline

Why Spoofed Messages and Validation Assumptions Keep Winning

The Uncomfortable Truth: Bridge UX Wants Speed, Security Wants Paranoia

What To Watch Next

相關問答

你可能也喜歡

300万粉女神全是AI合成，伪造孤儿院，跨国「假慈善」一夜塌房

L2「再校准」：当 L1 变成自身的 Rollup，以太坊的终局是什么？

灰度投资公司向SEC提交首个Worldcoin现货ETF申请，股票代码GWLD

金钱的永恒碎片：三方支付没有第一性

加密法案 Clarity 闯关记：美国两党妥协之路布满荆棘

交易

熱門分類

熱門標籤