Skip to main content
AVOID.NET

CrossCurve Bridge

avoid.net/crosscurve-bridge→56/100·82% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 56. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −2.6; legitimacy credit long-running +4. Version history →

Why this score
Every page starts at65
Incidents it suffered (e.g. hacks)-20
Problems around it, caused by others-2.6
Long-running+4
Sum46

Score: 56/100 (kept between 0 and 100)

How scoring works →
anchored·3sjPih…N6H9
last updated 2026-10-10

Summary

CrossCurve Bridge is a cross-chain liquidity protocol formerly known as EYWA, built in partnership with Curve Finance and backed by Curve founder Michael Egorov. On February 2, 2026, the protocol was exploited for approximately $3 million after attackers discovered that its ReceiverAxelar smart contract failed to validate the origin of cross-chain messages, allowing fabricated instructions to drain PortalV2 contracts across multiple networks. The team invoked a SafeHarbor WhiteHat policy offering a 10% bounty, while threatening legal escalation if funds were not returned within 72 hours.

Connected Entities

14 entities · 60 linked investigations
Organizations
□CrossCurve Bridge□Hyperbridge55□Polygon54□Ethereum□Drift□THORChain□Arbitrum□KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus□Binance□CrossCurve□Optimism
Protocols
⌂Drift Protocol⌂LayerZero — DVN Single-Verifier Configuration Risk⌂Curve Finance
Relationships
  • Optimism→mentioned with→Arbitrum(65%)
  • Optimism→mentioned with→Ethereum(80%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Arbitrum(70%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Drift(85%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→THORChain(70%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Ethereum(80%)
  • Binance→mentioned with→Ethereum(65%)
  • Curve Finance→mentioned with→Ethereum(80%)
  • THORChain→mentioned with→Ethereum(70%)
  • CrossCurve→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(65%)
  • + 37 more
Also appears in
June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·8USD Coin (USDC)·71GeniusAI·60BNB Chain Bridge·51Polygon·54Hyperbridge (Polkadot-Ethereum Bridge)·55BtcTurk·52H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges·0PancakeBunny·56Syscoin·28

Connected Through

12 shared actors · 597 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about CrossCurve Bridge?
0
Accepted
1
Under review
0
Rejected / revoked

1 submission awaiting moderator review.

Timeline(7 events)

September 2023

Curve Finance founder Michael Egorov invested in EYWA Protocol (CrossCurve's predecessor), establishing the Curve partnership.

Cryptopolitan

3 May 2024

EYWA Protocol completed a $7 million seed round led by Michael Egorov, with participation from Fenbushi Capital, GBV Capital, Big Brain Holdings, Marshland Capital, and Mulana Capital.

Yahoo Finance / The Defiant

31 January 2026

On-chain data reportedly showed the CrossCurve PortalV2 contract balance dropping to near zero, approximately one day before the public announcement of the exploit.

Crypto.news (citing Arkham Intelligence)

2 February 2026

CrossCurve publicly confirmed its bridge was under active attack. Approximately $3 million was drained from PortalV2 contracts across multiple networks via spoofed cross-chain messages to the ReceiverAxelar contract.

BeInCrypto

2 February 2026

CrossCurve CEO Boris Povar identified 10 Ethereum addresses receiving stolen funds and issued a 72-hour SafeHarbor ultimatum offering a 10% bounty (~$300,000) for fund return, with threats of criminal and civil escalation upon non-compliance.

BanklessTimes

2 February 2026

Halborn published a technical post-mortem attributing the exploit to weak access controls in the ReceiverAxelar contract's expressExecute function, which failed to enforce that messages originated from the Axelar gateway.

Halborn

May 2026

PeckShield published a report counting CrossCurve among 8 bridge exploits totaling $328.6 million year-to-date in 2026.

Bitcoin.com News
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain14 Wayback Archives

Decision Log

  • #2rescore+28Recorded on Solana ✓10/10/2026, 6:45:00 PM
    slot 455364816 · hash 9GV1umU9KYd3fUbMcnAVJeMtSQAKRqSmb5Sz1D6h7uxd
  • #1publishRecorded on Solana ✓5/28/2026, 3:23:08 AM
    slot 422637610 · hash A3cTwJEQEXpLAkUuc6HyfnU3934hty9KexzYdoBRRguR

This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 14 of 15 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-code-investigator

generated: 5/28/2026, 2:26:46 AM

last updated: 10/10/2026, 6:45:00 PM

4 views

avoid.net — verified advice for a post-truth world