CrossCurve (formerly EYWA) Bridge Exploit (Feb 2026)
Last changed 2026-10-26 · Re-researched — Re-researched in full by the investigator agent; the text was rewritten from new research. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·JwdPyg…jdzjSummary
On February 1, 2026, CrossCurve, a cross-chain DEX and bridge protocol associated with EYWA Protocol and backed by Curve Finance founder Michael Egorov, was exploited through an unprotected expressExecute() function in its ReceiverAxelar contract, which let an attacker forge cross-chain messages and unlock tokens from PortalV2 across at least nine networks. Loss estimates range from about $1.4 million in realised liquid assets to about $3 million in total PortalV2 value drained, much of it in largely illiquid EYWA tokens. No funds had been confirmed recovered, and the attacker did not publicly respond to the team's bounty offers.
Connected Entities
12 entities · 60 linked investigations- Across Protocol→mentioned with→Arbitrum(60%)
- Across Protocol→mentioned with→Ethereum(70%)
- Across Protocol→mentioned with→Optimism(60%)
- CrossCurve Bridge Hack (February 2026)→mentioned with→Ethereum(80%)
- CrossCurve Bridge Hack (February 2026)→mentioned with→Optimism(60%)
- CrossCurve Bridge Hack (February 2026)→mentioned with→Across Protocol(80%)
- CrossCurve Bridge Hack (February 2026)→mentioned with→Mantle(60%)
- Mantle→mentioned with→Ethereum(80%)
- CrossCurve Bridge Hack (February 2026)→mentioned with→Arbitrum(70%)
- CrossCurve Bridge Hack (February 2026)→mentioned with→Wormhole(60%)
- + 37 more
Timeline(14 events)
September 2023
Curve Finance founder Michael Egorov becomes a backer of EYWA Protocol, reported alongside Fenbushi Capital and GBV Capital in its seed round.
Top VCs Join EYWA's Seed Round Led by Curve's Founder — The DefiantMay 2024
EYWA announces a $7 million seed round led by Michael Egorov, with Fenbushi Capital, GBV Capital, Big Brain Holdings, Marshland Capital and Mulana Capital.
Top VCs Join EYWA's Seed Round Led by Curve's Founder — GlobeNewswire (May 2024)December 2024
EYWA announces an additional round with a 1inch co-founder and Kenetic Fund, bringing disclosed funding to approximately $8.5 million.
$3 Million Reportedly Lost in CrossCurve Bridge Exploit — BeInCryptoJanuary 2026
Attacker reportedly identifies the unprotected expressExecute() function in CrossCurve's ReceiverAxelar contract and begins probing it.
CrossCurve's $3M Bridge Exploit: How One Missing Validation Check Drained a Multi-Chain Protocol in Minutes — BlockEden.xyzFebruary 2026
Primary exploit transaction executes on Ethereum (block 24,363,854) at 18:38:23 UTC, unlocking about 999.8 million EYWA tokens from PortalV2 via a spoofed Berachain message; further transactions drain Arbitrum and other chains, and PortalV2 falls from roughly $3 million to near zero.
EYWA PortalV2 Axelar Exploit Analysis — DarkNavyFebruary 2026
Stolen Arbitrum assets are converted to WETH via CoW Protocol and bridged to Ethereum via Across Protocol; EYWA tokens remain illiquid in the attacker wallet.
CrossCurve Bridge Hack: An Integration Blunder That Cost Millions — CantinaFebruary 2026
CEO Boris Povar confirms the exploit, urges users to halt activity, pauses bridge operations and opens a war room with MixBytes; ten Ethereum addresses linked to the exploit are published, and Curve Finance advises users to review exposure to CrossCurve-related pools.
CrossCurve Bridge Suffers $3M Exploit Across Multiple Chains — BanklessTimesFebruary 2026
CrossCurve issues a 72-hour SafeHarbor ultimatum (deadline counted from block 24,364,392): return 90% and keep a 10% bounty, or face criminal referrals, litigation and asset freezes.
CrossCurve Threatens Legal Action After $3M Cross-Chain Bridge Exploit — DecryptFebruary 2026
The 72-hour deadline passes; CrossCurve raises the bounty offer to 20% and signals escalation. No attacker response is publicly reported.
CrossCurve $1.4M Exploit: What Went Wrong? — QuillAudits MediumFebruary 2026
IoTeX ioTube bridge exploited for approximately $4.3–4.4 million via a compromised validator private key, a separate February 2026 bridge attack.
IoTeX Confirms $4.3M ioTube Bridge Breach — CryptoTimesMarch 2026
CrossCurve completes a Hashlock audit of its LayerZero OFT messaging contracts; one medium and three low findings resolved, rated 'Secure'.
CrossCurve Reinforces Cross-Chain Security with Hashlock Audit of OFT Messaging Layer — TheCryptoUpdatesMarch 2026
BlockEden publishes a technical post-mortem confirming the expressExecute attack flow and the threshold-of-1 configuration as enabling conditions.
CrossCurve's $3M Bridge Exploit: How One Missing Validation Check Drained a Multi-Chain Protocol in Minutes — BlockEden.xyzMay 2026
CryptoTimes reports 2026 bridge-hack losses above $328 million, listing CrossCurve among the early incidents.
Crypto Bridge Hacks Top $328M in 2026 as Cross-Chain Exploits Accelerate — CryptoTimesDecision Log
- slot 457752707 · hash 5ANwNpPbQGWbWh5HPt3Sy8LhRX2hg748V7xudBrvtSws
- slot 425238740 · hash HBNghmmfz25VjdSFqVk5gjevV13bmVXJKnFUjTX9iuit
- slot 425238736 · hash 2yj7xEQ43UQqKB5GHBmW6irmsBD8vV5cuMPuMKYYKvjN
- slot 425022936 · hash 65u4MzY1UdKN4Bx37MpKNUAX9YoeZjgEPhYtNsLobxza
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 29 of 34 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/8/2026, 2:45:36 AM
last updated: 10/26/2026, 9:40:21 PM
5 viewsavoid.net — verified advice for a post-truth world