CrossCurve (formerly EYWA) Bridge Exploit (Feb 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·JwdPyg…jdzjSummary
On February 1, 2026, CrossCurve — a cross-chain DEX and bridge protocol operating under the EYWA brand — suffered a critical exploit of its ReceiverAxelar bridge contract via a missing Axelar Gateway validation check. Approximately $1.4 million in liquid assets were confirmed stolen, while the total PortalV2 contract balance drained was approximately $3 million (including largely illiquid EYWA tokens). No funds were recovered as of the investigation date.
Connected Entities
10 entities · 60 linked investigations- Across Protocol→mentioned with→Arbitrum(60%)
- Across Protocol→mentioned with→Ethereum(70%)
- Across Protocol→mentioned with→Optimism(60%)
- Mantle→mentioned with→Ethereum(80%)
- Optimism→mentioned with→Arbitrum(65%)
- Optimism→mentioned with→Ethereum(80%)
- Curve Finance→mentioned with→Ethereum(80%)
- CrossCurve (formerly EYWA) Bridge Exploit (Feb 2026)→mentioned with→Ethereum(80%)
- CrossCurve (formerly EYWA) Bridge Exploit (Feb 2026)→mentioned with→Optimism(60%)
- CrossCurve (formerly EYWA) Bridge Exploit (Feb 2026)→mentioned with→CrossCurve(70%)
- + 25 more
Timeline(10 events)
September 2023
Curve Finance founder Michael Egorov joins EYWA as a backer in its seed round alongside Fenbushi Capital and GBV Capital. Total fundraising reported at $7–8.5 million.
The Defiant — Top VCs Join EYWA's Seed Round Led by Curve's Founder31 January 2026
Attacker identifies the unprotected expressExecute() function in CrossCurve's ReceiverAxelar contract and begins probing the vulnerability.
CrossCurve's $3M Bridge Exploit — BlockEden.xyzFebruary 2026
At 18:38:23 UTC, the primary exploit transaction executes on Ethereum (block 24,363,854), draining the PortalV2 contract of approximately 999.8 million EYWA tokens via a spoofed Berachain cross-chain message. Subsequent transactions target Arbitrum and other supported chains, extracting liquid assets including USDT.
EYWA PortalV2 Axelar Exploit Analysis — DarkNavyFebruary 2026
Stolen Arbitrum assets converted to WETH via CoW Protocol and bridged to Ethereum through Across Protocol. EYWA tokens remain in attacker's primary wallet, illiquid.
CrossCurve Bridge Hack: An Integration Blunder — CantinaFebruary 2026
CrossCurve CEO Boris Povar publicly confirms the exploit, urges all users to halt protocol activity, and activates a war room with MixBytes. Ten Ethereum addresses linked to the hack are publicly identified.
CrossCurve Bridge Suffers $3M Exploit Across Multiple Chains — BanklessTimes2 February 2026
CrossCurve issues 72-hour ultimatum under SafeHarbor WhiteHat policy: return 90% of funds (retain 10% bounty) or face criminal referrals, civil litigation, and exchange-level asset freezes coordinated via Chainalysis and TRM Labs. Deadline counted from block 24,364,392.
CrossCurve Threatens Legal Action After $3M Cross-Chain Bridge Exploit — Decrypt5 February 2026
CrossCurve escalates bounty offer to 20% in an attempt to incentivize attacker cooperation. No response from attacker is publicly reported.
CrossCurve $1.4M Exploit: What Went Wrong? — QuillAudits Medium21 February 2026
IoTeX ioTube bridge exploited for approximately $4.3–4.4 million via compromised validator private key, representing a separate February 2026 bridge attack.
IoTeX Confirms $4.3M ioTube Bridge Breach — CryptoTimesMarch 2026
CrossCurve completes Hashlock audit of its LayerZero OFT messaging contracts. One medium and three low-severity findings identified and resolved. Contracts awarded a 'Secure' rating.
CrossCurve Reinforces Cross-Chain Security with Hashlock Audit — TheCryptoUpdatesDecision Log
- slot 457752707 · hash 5ANwNpPbQGWbWh5HPt3Sy8LhRX2hg748V7xudBrvtSws
- slot 425238740 · hash HBNghmmfz25VjdSFqVk5gjevV13bmVXJKnFUjTX9iuit
- slot 425238736 · hash 2yj7xEQ43UQqKB5GHBmW6irmsBD8vV5cuMPuMKYYKvjN
- slot 425022936 · hash 65u4MzY1UdKN4Bx37MpKNUAX9YoeZjgEPhYtNsLobxza
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 22 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/8/2026, 2:45:36 AM
last updated: 6/8/2026, 2:45:36 AM
5 viewsavoid.net — verified advice for a post-truth world