Audit log

Every state-changing event for CrossCurve Bridge Hack (February 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-28 17:46:16Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   HLTQqnJHH8tg…WG3Cukcpcopysha256 → base58

   verifying row…

   canonical bytes (22519 B) ▸

   {"actor":"system:backfill","investigation_id":"0d219d46-bfbe-49c6-a22d-bcb6fe3bd42a","kind":"publish","page_slug":"crosscurve-bridge-hack-february-2026","published_at":"2026-07-28T17:46:16.344Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"CrossCurve Bridge Hack (February 2026)","sections":[{"content":"On February 1-2, 2026, CrossCurve's cross-chain bridge infrastructure was exploited for approximately $3 million in digital assets. CrossCurve operates a 'Consensus Bridge' that routes cross-chain transactions through multiple independent validation protocols including Axelar, LayerZero, and its proprietary EYWA Oracle Network. The exploit targeted the ReceiverAxelar smart contract, which processes cross-chain messages relayed via the Axelar messaging layer. The PortalV2 contract, which held user liquidity, dropped from roughly $3 million to near zero during the attack. The exploit affected at least nine blockchain networks: Ethereum, Arbitrum, Optimism, Base, Mantle, Kava, Frax, Celo, and Blast. BlockSec estimated the total loss at approximately $2.76 million ($1.3 million on Ethereum; $1.28 million on Arbitrum), while other security researchers and media reports cited figures up to $3 million.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"CrossCurve bridge exploited for approximately $3 million across multiple chains via spoofed messages","type":"news_article","url":"https://www.theblock.co/post/387939/crosscurve-bridge-exploited-for-approximately-3-million-across-multiple-chains-via-spoofed-messages"},{"credibility":2,"name":"CrossCurve Threatens Legal Action After $3M Cross-Chain Bridge Exploit","type":"news_article","url":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit"},{"credibility":2,"name":"CrossCurve Bridge Suffers $3M Exploit Across Multiple Chains","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/02/02/crosscurve-bridge-suffers-3m-exploit-across-multiple-chains/"},{"credibility":2,"name":"CrossCurve Suffers $3M Loss in Cross-Chain Smart Contract Breach","type":"news_article","url":"https://www.cryptotimes.io/2026/02/02/crosscurve-suffers-3m-loss-in-cross-chain-smart-contract-breach/"}]},{"content":"The root cause of the exploit was a missing access-control check in the expressExecute() function of the ReceiverAxelar smart contract. The expressExecute() function, inherited from Axelar's AxelarExpressExecutable base contract, is designed for expedited cross-chain execution. Unlike the standard execute() function, expressExecute() does not perform gateway validation — it only checks that a supplied commandId has not previously been used. Because CrossCurve's deployment did not override this function with additional authentication logic, the function was publicly callable by any address. An attacker supplied a fresh, unused commandId (trivially satisfying the only existing check) along with attacker-controlled parameters specifying 'berachain' as the source chain and a pre-authorized peer address. The contract decoded the attacker-crafted payload and executed a BURN-UNLOCK opcode sequence, which flowed through CrossChainFacet and called the internal _unlock() function, releasing tokens from PortalV2 to attacker-controlled addresses. Additionally, CrossCurve's Consensus Bridge operated with a confirmation threshold of 1 for certain source chains, effectively disabling multi-guardian verification and contradicting the protocol's advertised multi-source consensus security model.","heading":"Technical Vulnerability","severity":"critical","sources":[{"credibility":2,"name":"CrossCurve Bridge Hack: An Integration Blunder That Cost Millions (Cantina)","type":"research","url":"https://cantina.xyz/blog/crosscurve-bridge-hack-axelar-expressexecute"},{"credibility":2,"name":"CrossCurve Exploit Post-Mortem: $1.4M Lost to a Missing Access Control Check (Olympix)","type":"research","url":"https://olympixai.medium.com/crosscurve-exploit-post-mortem-1-4m-lost-to-a-missing-access-control-check-c128e0aeb360"},{"credibility":3,"name":"The CrossCurve $3M Bridge Exploit: How One Missing Check Let Attackers Forge Cross-Chain Messages (DEV Community)","type":"research","url":"https://dev.to/ohmygod/the-crosscurve-3m-bridge-exploit-how-one-missing-check-let-attackers-forge-cross-chain-messages-516m"},{"credibility":2,"name":"Explained: The CrossCurve Hack (February 2026) (Halborn)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-crosscurve-hack-february-2026"},{"credibility":2,"name":"CrossCurve's $3M Bridge Exploit: How One Missing Validation Check Drained a Multi-Chain Protocol in Minutes (BlockEden)","type":"research","url":"https://blockeden.xyz/blog/2026/03/16/crosscurve-3m-bridge-exploit-axelar-gateway-fabricated-cross-chain-messages/"}]},{"content":"The attack was initiated on February 1, 2026 at approximately 06:38 PM UTC. The primary attacker address identified by security researchers is 0x632400f42e96a5deb547a179ca46b02c22cd25cd, with funds on Ethereum transferred to 0x851c01d014b1ad2b1266ca48a4b5578b67194834. CrossCurve's CEO Boris Povar publicly identified ten Ethereum wallet addresses as having received misdirected funds, including 0xAc8f44ceCa92b2a4b30360E5bd3043850a0FFcbE and 0x8c259f1e53e79408095d0ba805554d4cdda15285. On Arbitrum, stolen assets including USDT were converted to WETH via Cow Protocol and then bridged to Ethereum through Across Protocol. EYWA native tokens stolen in the attack reportedly remained in the attacker's wallet due to insufficient on-chain liquidity for conversion. Security firm Olympix characterized the direct financial loss attributable to a single missing access-control check at approximately $1.4 million, while broader estimates inclusive of all chains and assets ranged up to $3 million.","heading":"Attack Sequence and Fund Movement","severity":"critical","sources":[{"credibility":2,"name":"CrossCurve Bridge Hack: An Integration Blunder (Cantina)","type":"research","url":"https://cantina.xyz/blog/crosscurve-bridge-hack-axelar-expressexecute"},{"credibility":2,"name":"CrossCurve Exploit Post-Mortem: $1.4M Lost to a Missing Access Control Check (Olympix)","type":"research","url":"https://olympixai.medium.com/crosscurve-exploit-post-mortem-1-4m-lost-to-a-missing-access-control-check-c128e0aeb360"},{"credibility":2,"name":"CrossCurve identifies 10 wallets involved in the $3M bridge exploit (TradingView/Invezz)","type":"news_article","url":"https://www.tradingview.com/news/invezz:71ef5f427094b:0-crosscurve-identifies-10-wallets-involved-in-the-3m-bridge-exploit/"},{"credibility":2,"name":"$3 Million Reportedly Lost in CrossCurve Bridge Exploit (BeInCrypto)","type":"news_article","url":"https://beincrypto.com/crosscurve-bridge-exploit-loss/"}]},{"content":"Upon detecting the exploit, CrossCurve's team immediately advised users to cease all interactions with the protocol's contracts and paused bridge operations by taking backends offline and halting router contracts across all networks. CEO Boris Povar issued a public statement designating a 72-hour deadline for the attacker to return stolen funds. The team offered a 10% bounty on any recovered amount as a whitehat incentive under the protocol's SafeHarbor policy, with 90% of funds to be returned to a designated recovery address. Povar's public statement indicated an initially conciliatory tone: 'These tokens were wrongfully taken from users due to a smart contract exploit. We do not believe this was intentional on your part, and there is no indication of malicious intent.' Following the 72-hour window, CrossCurve stated escalation measures would include criminal referrals to law enforcement, civil litigation, cooperation with centralized exchanges to freeze relevant assets, coordination with stablecoin issuers such as Circle, public disclosure of all identified wallet data, and collaboration with blockchain analytics firms. The team also reportedly coordinated with Curve Finance, which issued a separate advisory recommending that users holding votes in CrossCurve-related liquidity pools review their positions.","heading":"Team Response and Bounty Offer","severity":"high","sources":[{"credibility":2,"name":"CrossCurve Threatens Legal Action After $3M Cross-Chain Bridge Exploit (Decrypt)","type":"news_article","url":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit"},{"credibility":2,"name":"CrossCurve Bridge Suffers $3M Exploit Across Multiple Chains (BanklessTimes)","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/02/02/crosscurve-bridge-suffers-3m-exploit-across-multiple-chains/"},{"credibility":2,"name":"$3M CrossCurve Bridge Cyberattack Exposes Validation Flaw (The Cyber Express)","type":"news_article","url":"https://thecyberexpress.com/crosscurve-bridge-3m-cyberattack/"},{"credibility":2,"name":"CrossCurve Bridge Exploit Drains About $3M, Rekindling Cross-Chain Risk (CCN)","type":"news_article","url":"https://www.ccn.com/news/crypto/crosscurve-bridge-exploit-3m-cross-chain-risk-hack/"}]},{"content":"CrossCurve is the rebranded product of EYWA Protocol, a cross-chain decentralized exchange and bridge infrastructure project. EYWA/CrossCurve raised a $7 million seed round in May 2024 led by Curve Finance founder Michael Egorov, with additional participation from Fenbushi Capital, GBV Capital, Big Brain Holdings, Marshland Capital, and Mulana Capital. A subsequent financing round announced in December 2024 brought participation from 1inch co-founder and Kenetic Fund, raising total disclosed funding to approximately $8.5 million. The protocol's primary value proposition was connecting liquidity from multiple blockchain ecosystems — reportedly over $2 billion in total value — through a multi-validation consensus mechanism intended to reduce single points of failure compared to conventional bridge designs. The Consensus Bridge model routing through Axelar, LayerZero, and the EYWA Oracle Network was presented as a security improvement over single-relayer bridges. The February 2026 exploit demonstrated that even multi-layer bridge designs can contain critical vulnerabilities at the smart contract integration layer.","heading":"Background: Protocol and Funding History","severity":"medium","sources":[{"credibility":2,"name":"Top VCs Join EYWA's Seed Round Led by Curve's Founder (GlobeNewswire)","type":"news_article","url":"https://www.globenewswire.com/news-release/2024/05/02/2874548/0/en/Top-VCs-Join-EYWA-s-Seed-Round-Led-by-Curve-s-Founder.html"},{"credibility":2,"name":"Top VCs Join EYWA's Seed Round Led by Curve's Founder (The Defiant)","type":"news_article","url":"https://thedefiant.io/news/press-releases/top-vcs-join-eywas-seed-round-led-by-curves-founder"},{"credibility":3,"name":"Exploring a New Future of Cross-Chain Interoperability - Introduction to EYWA (Gate.com)","type":"other","url":"https://www.gate.com/learn/articles/what-is-eywa-exploring-the-new-future-of-cross-chain-interoperability/5350"}]},{"content":"The CrossCurve exploit occurred within an environment of accelerating cross-chain bridge attacks in 2026. According to a May 2026 report, crypto bridge hacks exceeded $328 million in total losses through mid-year, with the CrossCurve incident counted among the early 2026 cases. The attack reaffirmed a pattern observed in previous bridge exploits — including Ronin ($625 million, 2022), Nomad ($190 million, 2022), and Wormhole ($320 million, 2022) — in which cross-chain message validation is a recurring attack surface. Security researchers at Halborn, Cantina, Olympix, and QuillAudits each published post-mortem analyses of the CrossCurve incident, with Cantina specifically identifying the Axelar expressExecute integration pattern as a systemic risk for any protocol inheriting the base contract without overriding its validation logic.","heading":"Broader Industry Context","severity":"medium","sources":[{"credibility":2,"name":"Crypto Bridge Hacks Top $328M in 2026 as Cross-Chain Exploits Accelerate (CryptoTimes)","type":"news_article","url":"https://www.cryptotimes.io/2026/05/18/crypto-bridge-hacks-top-328m-in-2026-as-cross-chain-exploits-accelerate/"},{"credibility":2,"name":"CrossCurve Bridge Hack: An Integration Blunder (Cantina)","type":"research","url":"https://cantina.xyz/blog/crosscurve-bridge-hack-axelar-expressexecute"},{"credibility":2,"name":"Cross Curve $1.4M Implementation Bug Explained (QuillAudits)","type":"research","url":"https://www.quillaudits.com/blog/hack-analysis/cross-curve-exploit"}]},{"content":"As of available public reporting through mid-2026, no confirmed recovery of stolen funds has been documented. The attacker did not publicly respond to the 72-hour ultimatum or the bounty offer. Stolen EYWA native tokens reportedly remained in the attacker's wallet because insufficient liquidity prevented conversion. Assets that were converted on Arbitrum (to WETH via Cow Protocol and bridged to Ethereum via Across Protocol) have not been traced to any exchange deposit or freezing action in available sources. CrossCurve stated it would coordinate with centralized exchanges and stablecoin issuers to freeze assets, but no public confirmation of successful freezes has been reported. The ultimate outcome of any law enforcement referrals has not been publicly disclosed as of the time of this investigation.","heading":"Fund Recovery Status","severity":"high","sources":[{"credibility":2,"name":"CrossCurve Bridge Hack: An Integration Blunder (Cantina)","type":"research","url":"https://cantina.xyz/blog/crosscurve-bridge-hack-axelar-expressexecute"},{"credibility":2,"name":"CrossCurve Exploit Post-Mortem: $1.4M Lost to a Missing Access Control Check (Olympix)","type":"research","url":"https://olympixai.medium.com/crosscurve-exploit-post-mortem-1-4m-lost-to-a-missing-access-control-check-c128e0aeb360"},{"credibility":2,"name":"CrossCurve Threatens Legal Action After $3M Cross-Chain Bridge Exploit (Decrypt)","type":"news_article","url":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit"}]}],"sources_used":[{"credibility":2,"name":"CrossCurve bridge exploited for approximately $3 million across multiple chains via spoofed messages (The Block)","type":"news_article","url":"https://www.theblock.co/post/387939/crosscurve-bridge-exploited-for-approximately-3-million-across-multiple-chains-via-spoofed-messages"},{"credibility":2,"name":"CrossCurve Threatens Legal Action After $3M Cross-Chain Bridge Exploit (Decrypt)","type":"news_article","url":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit"},{"credibility":2,"name":"CrossCurve Bridge Suffers $3M Exploit Across Multiple Chains (BanklessTimes)","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/02/02/crosscurve-bridge-suffers-3m-exploit-across-multiple-chains/"},{"credibility":2,"name":"CrossCurve Suffers $3M Loss in Cross-Chain Smart Contract Breach (CryptoTimes)","type":"news_article","url":"https://www.cryptotimes.io/2026/02/02/crosscurve-suffers-3m-loss-in-cross-chain-smart-contract-breach/"},{"credibility":2,"name":"$3M CrossCurve Bridge Cyberattack Exposes Validation Flaw (The Cyber Express)","type":"news_article","url":"https://thecyberexpress.com/crosscurve-bridge-3m-cyberattack/"},{"credibility":2,"name":"$3 Million Reportedly Lost in CrossCurve Bridge Exploit (BeInCrypto)","type":"news_article","url":"https://beincrypto.com/crosscurve-bridge-exploit-loss/"},{"credibility":2,"name":"CrossCurve Bridge Exploit Drains About $3M, Rekindling Cross-Chain Risk (CCN)","type":"news_article","url":"https://www.ccn.com/news/crypto/crosscurve-bridge-exploit-3m-cross-chain-risk-hack/"},{"credibility":2,"name":"CrossCurve Bridge Hack: An Integration Blunder That Cost Millions (Cantina)","type":"research","url":"https://cantina.xyz/blog/crosscurve-bridge-hack-axelar-expressexecute"},{"credibility":2,"name":"CrossCurve Exploit Post-Mortem: $1.4M Lost to a Missing Access Control Check (Olympix)","type":"research","url":"https://olympixai.medium.com/crosscurve-exploit-post-mortem-1-4m-lost-to-a-missing-access-control-check-c128e0aeb360"},{"credibility":2,"name":"Explained: The CrossCurve Hack (February 2026) (Halborn)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-crosscurve-hack-february-2026"},{"credibility":2,"name":"CrossCurve's $3M Bridge Exploit: How One Missing Validation Check Drained a Multi-Chain Protocol in Minutes (BlockEden)","type":"research","url":"https://blockeden.xyz/blog/2026/03/16/crosscurve-3m-bridge-exploit-axelar-gateway-fabricated-cross-chain-messages/"},{"credibility":2,"name":"Cross Curve $1.4M Implementation Bug Explained (QuillAudits)","type":"research","url":"https://www.quillaudits.com/blog/hack-analysis/cross-curve-exploit"},{"credibility":2,"name":"CrossCurve identifies 10 wallets involved in the $3M bridge exploit (TradingView/Invezz)","type":"news_article","url":"https://www.tradingview.com/news/invezz:71ef5f427094b:0-crosscurve-identifies-10-wallets-involved-in-the-3m-bridge-exploit/"},{"credibility":2,"name":"Top VCs Join EYWA's Seed Round Led by Curve's Founder (GlobeNewswire, May 2024)","type":"news_article","url":"https://www.globenewswire.com/news-release/2024/05/02/2874548/0/en/Top-VCs-Join-EYWA-s-Seed-Round-Led-by-Curve-s-Founder.html"},{"credibility":2,"name":"Top VCs Join EYWA's Seed Round Led by Curve's Founder (The Defiant)","type":"news_article","url":"https://thedefiant.io/news/press-releases/top-vcs-join-eywas-seed-round-led-by-curves-founder"},{"credibility":2,"name":"Crypto Bridge Hacks Top $328M in 2026 as Cross-Chain Exploits Accelerate (CryptoTimes)","type":"news_article","url":"https://www.cryptotimes.io/2026/05/18/crypto-bridge-hacks-top-328m-in-2026-as-cross-chain-exploits-accelerate/"},{"credibility":3,"name":"The CrossCurve $3M Bridge Exploit (DEV Community)","type":"research","url":"https://dev.to/ohmygod/the-crosscurve-3m-bridge-exploit-how-one-missing-check-let-attackers-forge-cross-chain-messages-516m"},{"credibility":2,"name":"CrossCurve Bridge Hacked for $3M (CoinCentral)","type":"news_article","url":"https://coincentral.com/crosscurve-bridge-hacked-for-3m-as-vulnerable-smart-contract-gets-exploited-across-chains/"}],"summary":"CrossCurve, a cross-chain DeFi bridge formerly known as EYWA Protocol and backed by Curve Finance founder Michael Egorov, suffered an approximately $3 million exploit on February 1-2, 2026. An attacker exploited a missing access-control validation in the protocol's ReceiverAxelar smart contract to forge cross-chain messages and unlock tokens without corresponding deposits across Ethereum, Arbitrum, and at least seven other networks. As of available reporting, no funds have been confirmed recovered and the attacker has not publicly responded to the team's 72-hour bounty ultimatum.","timeline":[{"date":"2023-09-01","event":"Curve Finance founder Michael Egorov becomes an early investor in EYWA Protocol (later rebranded CrossCurve).","source":"GlobeNewswire / The Defiant","source_url":"https://www.globenewswire.com/news-release/2024/05/02/2874548/0/en/Top-VCs-Join-EYWA-s-Seed-Round-Led-by-Curve-s-Founder.html"},{"date":"2024-05-02","event":"EYWA Protocol announces a $7 million seed round led by Michael Egorov (Curve Finance), with Fenbushi Capital, GBV Capital, Big Brain Holdings, Marshland Capital, and Mulana Capital participating.","source":"GlobeNewswire","source_url":"https://www.globenewswire.com/news-release/2024/05/02/2874548/0/en/Top-VCs-Join-EYWA-s-Seed-Round-Led-by-Curve-s-Founder.html"},{"date":"2024-12-21","event":"EYWA announces an additional financing round with participation from 1inch co-founder and Kenetic Fund, bringing total disclosed funding to approximately $8.5 million.","source":"Multiple sources","source_url":"https://beincrypto.com/crosscurve-bridge-exploit-loss/"},{"date":"2026-02-01","event":"Exploit begins at approximately 06:38 PM UTC. Attacker calls expressExecute() on CrossCurve's ReceiverAxelar contract with a forged cross-chain payload, exploiting missing gateway validation to unlock tokens from PortalV2 across multiple chains. PortalV2 balance drops from roughly $3 million to near zero.","source":"Cantina post-mortem; Olympix post-mortem","source_url":"https://cantina.xyz/blog/crosscurve-bridge-hack-axelar-expressexecute"},{"date":"2026-02-02","event":"CrossCurve publicly discloses the exploit, advises all users to halt interactions with the protocol, and pauses bridge operations. CEO Boris Povar issues a 72-hour ultimatum offering a 10% whitehat bounty for return of funds.","source":"The Block; Decrypt; BanklessTimes","source_url":"https://www.theblock.co/post/387939/crosscurve-bridge-exploited-for-approximately-3-million-across-multiple-chains-via-spoofed-messages"},{"date":"2026-02-02","event":"CrossCurve publishes ten Ethereum wallet addresses identified as having received exploited funds, including 0xAc8f44ceCa92b2a4b30360E5bd3043850a0FFcbE and 0x8c259f1e53e79408095d0ba805554d4cdda15285. Curve Finance separately advises users to review exposure to CrossCurve-related liquidity pools.","source":"BanklessTimes; CryptoTimes; Decrypt","source_url":"https://www.banklesstimes.com/articles/2026/02/02/crosscurve-bridge-suffers-3m-exploit-across-multiple-chains/"},{"date":"2026-02-05","event":"72-hour bounty deadline passes. CrossCurve indicates escalation to criminal referrals, civil litigation, and coordination with exchanges and analytics firms. No confirmed attacker response is publicly documented.","source":"Decrypt; BeInCrypto","source_url":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit"},{"date":"2026-03-16","event":"BlockEden publishes detailed technical post-mortem, confirming the attack flow through expressExecute and the threshold-of-1 configuration flaw as enabling conditions.","source":"BlockEden","source_url":"https://blockeden.xyz/blog/2026/03/16/crosscurve-3m-bridge-exploit-axelar-gateway-fabricated-cross-chain-messages/"},{"date":"2026-05-18","event":"CryptoTimes reports that crypto bridge hacks have exceeded $328 million in losses in 2026, listing CrossCurve as one of the early incidents in the year's elevated attack environment.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/05/18/crypto-bridge-hacks-top-328m-in-2026-as-cross-chain-exploits-accelerate/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 72e88401-bb31-495b-9f24-4b3a60ab0b47copy