{"investigation":{"slug":"crosscurve","entity_name":"CrossCurve","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"CrossCurve (formerly EYWA) is a cross-chain DeFi liquidity protocol built in partnership with Curve Finance, backed by $8.5 million in funding including a seed round led by Curve founder Michael Egorov. On February 1-2, 2026, the protocol suffered a critical smart contract exploit in its ReceiverAxelar bridge contract, resulting in an estimated $3 million in user losses across multiple chains; confirmed liquid losses were approximately $1.44 million after exchange freezes limited attacker liquidation. A subsequent Hashlock audit of separate OFT messaging contracts in March 2026 found and resolved additional vulnerabilities, and the protocol has not publicly confirmed full fund recovery from the February exploit.","sections":[{"content":"CrossCurve is a cross-chain trading and yield protocol developed by EYWA, a blockchain infrastructure company founded in 2021 by Boris Povar, Faraj Abutalibov, and Peter Tagunov and registered in Tortola, British Virgin Islands. The protocol operates as a 'DeFi MetaLayer' built on top of Curve Finance's automated market maker (AMM) infrastructure, aggregating Curve liquidity pools across more than 20 supported blockchains into a unified cross-chain market. CrossCurve's primary product enables low-slippage cross-chain swaps of stablecoins and other assets. In its first year of operation, the protocol reported over $21 million in TVL and approximately $1.85 billion in trading volume. CEO Boris Povar holds a background in mathematics and software engineering, with prior experience running an IT outsourcing firm and involvement in crypto markets since 2017.","heading":"Overview and Background","sources":[{"url":"https://crosscurve.fi/","name":"crosscurve.fi","type":"other","credibility":3},{"url":"https://docs.eywa.fi/eywa-ecosystem/team","name":"docs.eywa.fi","type":"other","credibility":3},{"url":"https://tracxn.com/d/companies/crosscurve/__nGqUTPDbr5mzlOWCUZlCLLaznFYA806Qh481XLIQOY8","name":"tracxn.com","type":"other","credibility":3},{"url":"https://crosscurve.medium.com/an-interview-with-eywa-ceo-boris-povar-92e21ae9ed07","name":"crosscurve.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In May 2024, EYWA completed a $7 million seed round led by Curve Finance founder Michael Egorov, with participation from Fenbushi Capital and GBV Capital. A subsequent smaller round followed in late 2024 with participation from 1inch co-founder Anton Bukov and Kenetic Fund. Total confirmed funding across private and public rounds reached approximately $8.5 million. Michael Egorov's participation as lead investor was significant given his simultaneous role as founder of Curve Finance, the liquidity infrastructure on which CrossCurve is built. Notably, Egorov was himself the subject of significant controversy in 2023 after a series of large collateralized loans against his CRV holdings triggered liquidations across multiple DeFi platforms.","heading":"Funding and Investors","sources":[{"url":"https://www.globenewswire.com/news-release/2024/05/03/2875386/0/en/Top-VCs-Join-EYWA-s-Seed-Round-Led-by-Curve-Founder.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/top-vcs-join-eywas-seed-213000700.html","name":"finance.yahoo.com","type":"other","credibility":3},{"url":"https://cryptorank.io/ico/eywa","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On February 1-2, 2026, CrossCurve's PortalV2 bridge contract was exploited via a critical access control vulnerability in its ReceiverAxelar smart contract. The flaw allowed any user to call the expressExecute() function with a spoofed cross-chain message, bypassing gateway validation that should have authenticated the origin of the message as legitimate Axelar cross-chain traffic. Because no source validation was enforced, an attacker could craft arbitrary payloads instructing the PortalV2 contract to release tokens as though a legitimate deposit had been made on a source chain. The confirmation threshold was also misconfigured at 1, effectively disabling multi-guardian validation. The exploit was executed across multiple chains including Ethereum, Arbitrum, Optimism, Base, Mantle, Kava, Frax, Celo, and Blast. Initial reports from security monitoring services cited approximately $3 million in total losses. QuillAudits' post-mortem analysis confirmed $1,441,892.31 in assets successfully removed by the attacker and remaining under attacker control; the discrepancy with the $3 million figure reflects the fact that a large quantity of minted EYWA tokens were frozen by XT Exchange and could not be liquidated. The PortalV2 contract's balance dropped from approximately $3 million to near zero on January 31, 2026.","heading":"February 2026 Bridge Exploit","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-crosscurve-hack-february-2026","name":"halborn.com","type":"other","credibility":3},{"url":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/cross-curve-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://beincrypto.com/crosscurve-bridge-exploit-loss/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://thecyberexpress.com/crosscurve-bridge-3m-cyberattack/","name":"thecyberexpress.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/02/02/crosscurve-suffers-3m-loss-in-cross-chain-bridge-breach/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Following detection of the exploit, CrossCurve CEO Boris Povar publicly identified ten Ethereum addresses that received the stolen funds and issued a 72-hour ultimatum beginning from block 24364392. The statement read: 'We do not believe this was intentional on your part, and there is no indication of malicious intent,' but warned that failure to return funds would result in 'criminal referrals, civil litigation, coordination with exchanges to freeze assets,' and cooperation with law enforcement. CrossCurve invoked its Safe Harbor WhiteHat policy, offering up to 10% of recovered funds as a bounty incentive. The protocol also sent on-chain messages to the attacker's wallet addresses. No public confirmation of any fund recovery or legal proceedings has been reported as of May 2026. The protocol paused all contracts and user activity during the investigation.","heading":"Team Response and Legal Threats","sources":[{"url":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.thecoinrepublic.com/2026/02/02/crypto-hack-crosscurve-warns-users-to-halt-activity-as-bridge-comes-under-attack/","name":"thecoinrepublic.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/crosscurve-users-exploited-for-around-3-million","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/crosscurve-threatens-legal-action-3m-054416969.html","name":"finance.yahoo.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In March 2026, CrossCurve commissioned an audit of its LayerZero-based OFT (Omnichain Fungible Token) messaging contracts through Web3 security firm Hashlock. The audit covered five contracts: CrossCurveCore.sol, OFTAdapter.sol, MintBurnOFTAdapter.sol, CrossCurveOFTStorage.sol, and OptionsReader.sol. The review identified one medium-severity vulnerability, three low-severity findings, and one QA observation; Hashlock reported all issues were resolved and awarded the contracts a 'Secure' rating. The firm noted the codebase follows industry best practices and makes appropriate use of OpenZeppelin libraries. This audit covered contracts separate from the exploited ReceiverAxelar contract, representing a broadened security scope rather than a direct remediation audit of the attacked component.","heading":"Post-Exploit Security Remediation","sources":[{"url":"https://www.mexc.com/news/1028361","name":"mexc.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-crosscurve-hack-february-2026","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"CrossCurve's native EYWA token reached an all-time high of approximately $0.252 on December 27, 2024. As of May 2026, the token trades at approximately $0.001-0.002, representing a decline of approximately 99% from its ATH. TVL as reported by DefiLlama stands at approximately $20.27 million, roughly consistent with pre-exploit levels. The protocol appears to remain operational. No regulatory actions by the SEC, CFTC, or other authorities have been publicly reported against CrossCurve or EYWA as of May 2026.","heading":"Token and Protocol Status","sources":[{"url":"https://www.coingecko.com/en/coins/eywa","name":"coingecko.com","type":"other","credibility":3},{"url":"https://defillama-ui.vercel.app/protocol/crosscurve-(by-eywa)?denomination=USD","name":"defillama-ui.vercel.app","type":"other","credibility":3},{"url":"https://cryptorank.io/price/eywa","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://chainbroker.io/projects/crosscurve/","name":"chainbroker.io","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, the pseudonymous on-chain investigator who joined Paradigm as an incident response advisor in February 2025, is reported to have flagged CrossCurve. The specific nature, date, and content of ZachXBT's flag on CrossCurve are not confirmed through verifiable public sources as of this investigation. ZachXBT's methodology typically involves on-chain fund tracing, wallet clustering, and cross-referencing blockchain data with public records. No published ZachXBT thread specifically addressing CrossCurve could be verified at the time of this investigation.","heading":"ZachXBT Flag","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://thedefiant.io/news/markets/crypto-traders-attempt-to-frontrun-zachxbt-s-upcoming-expose","name":"thedefiant.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The CrossCurve exploit is part of a broader pattern of cross-chain bridge vulnerabilities. Cross-chain bridges are considered among the most dangerous attack surfaces in DeFi due to the complexity of validating messages across heterogeneous blockchain environments. According to industry analysis, bridge exploits accounted for over $140 million in losses across 2025-2026. The ReceiverAxelar vulnerability class — where cross-chain message authenticity is not properly verified — is a well-documented attack vector. The CrossCurve incident bears technical similarities to prior bridge exploits including Ronin ($625M, 2022), Nomad ($190M, 2022), and others that exploited inadequate message validation.","heading":"Cross-Chain Bridge Risk Context","sources":[{"url":"https://dev.to/ohmygod/cross-chain-bridge-security-checklist-7-lessons-from-140m-in-bridge-exploits-2025-2026-5ap3","name":"dev.to","type":"other","credibility":3},{"url":"https://www.ccn.com/news/crypto/crosscurve-bridge-exploit-3m-cross-chain-risk-hack/","name":"ccn.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"EYWA protocol founded by Boris Povar, Faraj Abutalibov, and Peter Tagunov in Tortola, British Virgin Islands.","source":"","date_original":"2021-01-01"},{"date":"2023-09","event":"Curve Finance founder Michael Egorov reportedly backs CrossCurve as an early investor.","source":"","date_original":"2023-09-01"},{"date":"2024-05-03","event":"EYWA completes $7 million seed round led by Michael Egorov, with participation from Fenbushi Capital and GBV Capital.","source":""},{"date":"2024-12-21","event":"EYWA announces additional funding round with participation from 1inch co-founder Anton Bukov and Kenetic Fund, bringing total raised to approximately $8.5 million.","source":""},{"date":"2024-12-27","event":"EYWA token reaches all-time high of approximately $0.252.","source":""},{"date":"2026-01-31","event":"PortalV2 contract balance drops from approximately $3 million to near zero; exploit begins.","source":""},{"date":"2026-02","event":"CrossCurve confirms active bridge exploit across multiple networks; team pauses all contracts and warns users to halt activity.","source":"","date_original":"2026-02-01"},{"date":"2026-02-02","event":"CEO Boris Povar identifies 10 Ethereum addresses receiving stolen funds, issues 72-hour ultimatum with 10% bounty offer, and threatens criminal referrals and civil litigation.","source":""},{"date":"2026-02-02","event":"XT Exchange freezes EYWA token deposits, preventing attacker liquidation of approximately 999.8 million minted EYWA tokens.","source":""},{"date":"2026-03","event":"CrossCurve commissions Hashlock audit of LayerZero OFT messaging contracts; audit concludes with 'Secure' rating after resolution of identified vulnerabilities.","source":"","date_original":"2026-03-01"},{"date":"2026-03-25","event":"QuillAudits publishes post-mortem analysis confirming confirmed liquid losses of $1,441,892.31 from the February exploit.","source":""}],"sources_used":[{"url":"https://crosscurve.fi/","name":"crosscurve.fi","type":"other","archive_url":"http://web.archive.org/web/20260505110527/https://crosscurve.fi/","credibility":3,"archive_timestamp":"2026-05-05T11:05:27+00:00"},{"url":"https://docs.eywa.fi/eywa-ecosystem/team","name":"docs.eywa.fi","type":"other","archive_url":"http://web.archive.org/web/20260520184747/https://docs.eywa.fi/eywa-ecosystem/team","credibility":3,"archive_timestamp":"2026-05-20T18:47:47+00:00"},{"url":"https://tracxn.com/d/companies/crosscurve/__nGqUTPDbr5mzlOWCUZlCLLaznFYA806Qh481XLIQOY8","name":"tracxn.com","type":"other","archive_url":"https://web.archive.org/web/20260829180611/https://tracxn.com/d/companies/crosscurve/__nGqUTPDbr5mzlOWCUZlCLLaznFYA806Qh481XLIQOY8#news","credibility":3,"archive_timestamp":"2026-08-29T18:06:11+00:00"},{"url":"https://crosscurve.medium.com/an-interview-with-eywa-ceo-boris-povar-92e21ae9ed07","name":"crosscurve.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.globenewswire.com/news-release/2024/05/03/2875386/0/en/Top-VCs-Join-EYWA-s-Seed-Round-Led-by-Curve-Founder.html","name":"globenewswire.com","type":"other","archive_url":"https://web.archive.org/web/20260829090132/https://www.globenewswire.com/news-release/2024/05/03/2875386/0/en/Top-VCs-Join-EYWA-s-Seed-Round-Led-by-Curve-Founder.html","credibility":3,"archive_timestamp":"2026-08-29T09:01:32+00:00"},{"url":"https://finance.yahoo.com/news/top-vcs-join-eywas-seed-213000700.html","name":"finance.yahoo.com","type":"other","archive_url":"http://web.archive.org/web/20260208085729/https://finance.yahoo.com/news/top-vcs-join-eywas-seed-213000700.html","credibility":3,"archive_timestamp":"2026-02-08T08:57:29+00:00"},{"url":"https://cryptorank.io/ico/eywa","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829030548/https://cryptorank.io/ico/eywa","credibility":3,"archive_timestamp":"2026-08-29T03:05:48+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-crosscurve-hack-february-2026","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260315165952/https://www.halborn.com/blog/post/explained-the-crosscurve-hack-february-2026","credibility":3,"archive_timestamp":"2026-03-15T16:59:52+00:00"},{"url":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260811070706/https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit","credibility":3,"archive_timestamp":"2026-08-11T07:07:06+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/cross-curve-exploit","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260515101708/https://www.quillaudits.com/blog/hack-analysis/cross-curve-exploit","credibility":3,"archive_timestamp":"2026-05-15T10:17:08+00:00"},{"url":"https://beincrypto.com/crosscurve-bridge-exploit-loss/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20260202045605/https://beincrypto.com/crosscurve-bridge-exploit-loss/","credibility":3,"archive_timestamp":"2026-02-02T04:56:05+00:00"},{"url":"https://thecyberexpress.com/crosscurve-bridge-3m-cyberattack/","name":"thecyberexpress.com","type":"other","archive_url":"http://web.archive.org/web/20260312052521/https://thecyberexpress.com/crosscurve-bridge-3m-cyberattack/","credibility":3,"archive_timestamp":"2026-03-12T05:25:21+00:00"},{"url":"https://www.cryptotimes.io/2026/02/02/crosscurve-suffers-3m-loss-in-cross-chain-bridge-breach/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829122121/https://www.cryptotimes.io/2026/02/02/crosscurve-suffers-3m-loss-in-cross-chain-bridge-breach/","credibility":3,"archive_timestamp":"2026-08-29T12:21:21+00:00"},{"url":"https://www.thecoinrepublic.com/2026/02/02/crypto-hack-crosscurve-warns-users-to-halt-activity-as-bridge-comes-under-attack/","name":"thecoinrepublic.com","type":"other","archive_url":"https://web.archive.org/web/20260829181508/https://www.thecoinrepublic.com/2026/02/02/crypto-hack-crosscurve-warns-users-to-halt-activity-as-bridge-comes-under-attack/","credibility":3,"archive_timestamp":"2026-08-29T18:15:08+00:00"},{"url":"https://www.web3isgoinggreat.com/single/crosscurve-users-exploited-for-around-3-million","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260309123811/https://www.web3isgoinggreat.com/single/crosscurve-users-exploited-for-around-3-million","credibility":3,"archive_timestamp":"2026-03-09T12:38:11+00:00"},{"url":"https://finance.yahoo.com/news/crosscurve-threatens-legal-action-3m-054416969.html","name":"finance.yahoo.com","type":"other","archive_url":"http://web.archive.org/web/20260725192717/https://finance.yahoo.com/news/crosscurve-threatens-legal-action-3m-054416969.html","credibility":3,"archive_timestamp":"2026-07-25T19:27:17+00:00"},{"url":"https://www.mexc.com/news/1028361","name":"mexc.com","type":"other","archive_url":"http://web.archive.org/web/20260726155026/https://www.mexc.com/news/1028361","credibility":3,"archive_timestamp":"2026-07-26T15:50:26+00:00"},{"url":"https://www.coingecko.com/en/coins/eywa","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama-ui.vercel.app/protocol/crosscurve-(by-eywa)?denomination=USD","name":"defillama-ui.vercel.app","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptorank.io/price/eywa","name":"cryptorank.io","type":"other","archive_url":"http://web.archive.org/web/20260728191224/https://cryptorank.io/price/eywa","credibility":3,"archive_timestamp":"2026-07-28T19:12:24+00:00"},{"url":"https://chainbroker.io/projects/crosscurve/","name":"chainbroker.io","type":"other","archive_url":"https://web.archive.org/web/20260829073914/https://chainbroker.io/projects/crosscurve/","credibility":3,"archive_timestamp":"2026-08-29T07:39:14+00:00"},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"},{"url":"https://thedefiant.io/news/markets/crypto-traders-attempt-to-frontrun-zachxbt-s-upcoming-expose","name":"thedefiant.io","type":"other","archive_url":"http://web.archive.org/web/20260308204151/https://thedefiant.io/news/markets/crypto-traders-attempt-to-frontrun-zachxbt-s-upcoming-expose","credibility":3,"archive_timestamp":"2026-03-08T20:41:51+00:00"},{"url":"https://dev.to/ohmygod/cross-chain-bridge-security-checklist-7-lessons-from-140m-in-bridge-exploits-2025-2026-5ap3","name":"dev.to","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.ccn.com/news/crypto/crosscurve-bridge-exploit-3m-cross-chain-risk-hack/","name":"ccn.com","type":"other","archive_url":"http://web.archive.org/web/20260202130439/https://www.ccn.com/news/crypto/crosscurve-bridge-exploit-3m-cross-chain-risk-hack/","credibility":3,"archive_timestamp":"2026-02-02T13:04:39+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:18.88328+00:00","updated_at":"2026-08-30T07:44:38.024703+00:00"}}