← CrossCurve (formerly EYWA) Bridge Exploit (Feb 2026)reviewed 2026-10-16 · 22 claims checked
Fact-check findings
What an automated fact-checker found when it re-read CrossCurve (formerly EYWA) Bridge Exploit (Feb 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
7 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in section: Protocol Background and EYWA–CrossCurve Rebrand
“The EYWA project was founded in December 2020 and developed a cross-chain liquidity bridge leveraging Curve Finance's deep liquidity pools.”
reviewerEYWA Protocol was founded in December 2020The cited source does not actually state a founding date, and two independent company-data aggregators (CB Insights, Crunchbase) give 2021. 'December 2020' appears unsupported.Proposed correction (not yet applied)The EYWA project was founded in 2021 and developed a cross-chain liquidity bridge leveraging Curve Finance's deep liquidity pools. - #2[disputed][awaiting moderator]in the timeline
“2020-12”
reviewerEYWA Protocol founded (timeline entry date)Same defect as the section-0 founding-date claim; the timeline date field should be corrected in tandem.Proposed correction (not yet applied)2021 - #3[disputed][awaiting moderator]in section: Protocol Background and EYWA–CrossCurve Rebrand
“Curve Finance founder Michael Egorov became a backer in September 2023, and the project subsequently reported raising approximately $7–8.5 million across private and public funding rounds, with investors including Fenbushi Capital and GBV Capital.”
reviewerCurve Finance founder Michael Egorov became a backer of EYWA in September 2023The page's own cited source is dated May 2024, not September 2023, and four independent sources (DeFiLlama, CoinCarp, Nordic9, and the Defiant article itself) agree on a May 2024 date and a $7 million total, not the stated 2023 date or $8.5 million upper bound.Proposed correction (not yet applied)Curve Finance founder Michael Egorov became a backer in May 2024, and the project subsequently reported raising approximately $7 million across private and public funding rounds, with investors including Fenbushi Capital and GBV Capital. - #4[disputed][awaiting moderator]in the timeline
“2023-09”
reviewerEgorov joins EYWA seed round (timeline entry date)Same underlying date error as the section-0 claim.Proposed correction (not yet applied)2024-05 - #19[disputed][awaiting moderator]in section: Broader February 2026 Bridge Attack Wave
“Hyperbridge also suffered a reported $2.5 million exploit during the same period.”
reviewerHyperbridge also suffered a reported $2.5 million exploit during the same period (i.e., February 2026)The page's cited source (KuCoin) itself contains the same dating error, but a more specific, contemporaneous, tier-1 report (The Block) dates the actual Hyperbridge exploit to April 13, 2026, not February. The $2.5 million figure is accurate; the 'same period' (February 2026) framing is not.Proposed correction (not yet applied)Hyperbridge also suffered a reported $2.5 million exploit, though that incident occurred in April 2026, not within this February cluster. - #21[disputed][awaiting moderator]in the timeline
“Attacker identifies the unprotected expressExecute() function in CrossCurve's ReceiverAxelar contract and begins probing the vulnerability.”
reviewerAttacker identifies the unprotected expressExecute() function and begins probing the vulnerability on 2026-01-31The page invents a multi-stage 'discovery then probing then execution' narrative to reconcile two sources that actually conflict on the date (BlockEden says Jan 31 for both discovery and drain; on-chain data confirms the drain itself was Feb 1, 18:38 UTC). No source describes an actual extended probing period.Proposed correction (not yet applied)Attacker identifies the unprotected expressExecute() function in CrossCurve's ReceiverAxelar contract and begins exploiting the vulnerability. - #22[disputed][awaiting moderator]in the timeline
“2026-01-31”
reviewerAttacker probing date (timeline entry date field)Same defect as the event-text finding; the only verified exploit-related event is the Feb 1 transaction.Proposed correction (not yet applied)2026-02-01
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #14[unverifiable][awaiting moderator]in section: Team Response and Recovery Attempts
“The ultimatum was later escalated with an offer of 20% retention in an attempt to incentivize cooperation.”
reviewerThe ultimatum was later escalated with an offer of 20% retentionExtensive independent searching (multiple queries) found every available source citing only a 10% bounty, with no mention anywhere of a later 20% escalation. The specific cited source (QuillAudits Medium) could not be directly accessed (403) to confirm or refute. Flagged as unverifiable rather than disputed because no source was found that affirmatively contradicts it, only an absence of corroboration. - #15[unverifiable][awaiting moderator]in the timeline
“CrossCurve escalates bounty offer to 20% in an attempt to incentivize attacker cooperation. No response from attacker is publicly reported.”
reviewerCrossCurve escalates bounty offer to 20% on 2026-02-05 (timeline entry)Same unconfirmed detail as the section-5 claim above.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #12[partially supported][awaiting moderator]in section: Team Response and Recovery Attempts
“CrossCurve CEO Boris Povar responded publicly on X (Twitter), urging users to halt all activity with the protocol. The team activated a war room in coordination with security firm MixBytes to investigate the root cause. Within hours, the team identified ten Ethereum addresses linked to the exploit and published them publicly.”
reviewerCrossCurve CEO Boris Povar responded on X, war room activated with MixBytes, ten addresses identifiedThe ten-addresses and CEO-statement portions are well corroborated. The specific details that the response happened 'on X' and that a 'war room' was run 'in coordination with... MixBytes' were not found in any source I could access, including a dedicated search for MixBytes' involvement; this appears to be an unsourced embellishment.
confirmed
12 claimsThe cited evidence supports the claim as written.
- #5[confirmed][no action needed]in section: Exploit Overview and Financial Impact
“On February 1, 2026 at 18:38:23 UTC (Ethereum block 24,363,854), an attacker exploited CrossCurve's PortalV2 bridge contracts across multiple chains by abusing an unprotected expressExecute() function in the ReceiverAxelar smart contract.”
reviewerOn February 1, 2026 at 18:38:23 UTC (Ethereum block 24,363,854), an attacker exploited CrossCurve's PortalV2 via the ReceiverAxelar expressExecute() functionIndependently verified against raw on-chain data (Etherscan), which is the strongest possible confirmation. - #6[confirmed][no action needed]in section: Exploit Overview and Financial Impact
“Olympix and QuillAudits place confirmed liquid losses at approximately $1,441,892 — comprising USDT and other tokens on Arbitrum swapped to WETH via CoW Protocol and bridged to Ethereum via Across Protocol.”
reviewerOlympix and QuillAudits place confirmed liquid losses at approximately $1,441,892Confirmed via QuillAudits directly and corroborating independent commentary; Olympix article could not be fetched directly (403) but its publicly indexed title matches. - #7[confirmed][no action needed]in section: Exploit Overview and Financial Impact
“The Block and Decrypt reported the figure as approximately $3 million, reflecting the total pre-exploit PortalV2 balance including approximately 999,787,453 EYWA tokens that were extracted to the attacker's Ethereum wallet but were effectively illiquid due to the absence of on-chain liquidity and subsequent exchange freezes on EYWA deposits.”
reviewerThe Block and Decrypt reported the figure as approximately $3 million, reflecting total pre-exploit PortalV2 balance including ~999,787,453 EYWA tokensBoth the headline $3M figure and the precise EYWA token count are independently verified on-chain. - #8[confirmed][no action needed]in section: Exploit Overview and Financial Impact
“BlockSec estimated total losses at approximately $2.76 million, allocating roughly $1.3 million to Ethereum and $1.28 million to Arbitrum.”
reviewerBlockSec estimated total losses at approximately $2.76 million, allocating roughly $1.3 million to Ethereum and $1.28 million to ArbitrumFigure is independently corroborated, but note the section's own sources[] list does not include a BlockSec-authored URL for this specific sub-claim; a direct citation would strengthen traceability. - #9[confirmed][no action needed]in section: Technical Root Cause: Missing Axelar Gateway Validation
“CrossCurve's ReceiverAxelar contract inherited expressExecute() without overriding it or adding access controls. As a result, the function was publicly callable by any address with any fabricated payload.”
reviewerTechnical root cause: expressExecute() inherited without override, commandId bypass, sourceChain/sourceAddress spoofing (berachain / 0x5eEdDcE7...), consensus threshold of 1Well-supported by both research write-ups and primary on-chain data. Cantina's exact 'integration blunder' phrase could not be verified via direct fetch (redirect/404 issues), but search-engine indexing of the same Cantina post corroborates its substance (receiver-side integration failure, not an Axelar protocol flaw). - #10[confirmed][no action needed]in section: Attacker Addresses and Fund Movement
“The primary attacker address receiving unlocked funds is 0x632400f42e96a5deb547a179ca46b02c22cd25cd. A secondary holding address is 0x851c01d014b1ad2b1266ca48a4b5578b67194834, which received the bulk of the liquid WETH proceeds after conversion. The attack transaction on Ethereum is 0x37d9b911ef710be851a2e08e1cfc61c2544db0f208faeade29ee98cc7506ccc2. The PortalV2 victim contract address is 0xac8f44ceca92b2a4b30360e5bd3043850a0ffcbe.”
reviewerAttacker addresses and PortalV2/EYWA contract addresses, attack transaction hashAll addresses and the transaction hash check out exactly against primary on-chain data. - #11[confirmed][no action needed]in section: Chains Affected
“Confirmed affected chains include Ethereum (primary Axelar receiver exploit), Arbitrum (significant liquid asset drain), Optimism, Base, Mantle, Kava, Frax, Celo, and Blast.”
reviewerConfirmed affected chains include Ethereum, Arbitrum, Optimism, Base, Mantle, Kava, Frax, Celo, and BlastChain list matches BlockSec's reported breakdown found via independent search, though the CCN article itself could not be directly fetched (403). - #13[confirmed][no action needed]in section: Team Response and Recovery Attempts
“CrossCurve invoked its SafeHarbor WhiteHat policy, initially offering the attacker a 10% retention bounty (keep 10% of stolen funds, return 90% within 72 hours of block 24,364,392).”
reviewerCrossCurve invoked SafeHarbor WhiteHat policy, offering 10% retention bounty with a 72-hour deadlineWell supported by two independently fetched sources. - #16[confirmed][no action needed]in section: Team Response and Recovery Attempts
“The team warned that failure to make contact or return funds would result in criminal referrals, civil litigation, coordination with centralized exchanges and stablecoin issuers to freeze assets, and engagement of blockchain analytics firms Chainalysis and TRM Labs.”
reviewerFailure to return funds threatened criminal referrals, civil litigation, exchange/stablecoin freezes, and engagement of Chainalysis and TRM LabsConfirmed via broader corroborating coverage; the page omits that Elliptic was also named, which is a minor omission, not an inaccuracy. - #17[confirmed][no action needed]in section: Post-Exploit Security Remediation
“The Hashlock audit was finalized in March 2026 and covered five contracts: CrossCurveCore.sol, OFTAdapter.sol, MintBurnOFTAdapter.sol, CrossCurveOFTStorage.sol, and OptionsReader.sol. Hashlock identified one medium-severity and three low-severity findings, all of which CrossCurve resolved prior to the final report. Hashlock awarded the audited contracts a 'Secure' rating.”
reviewerHashlock audit of LayerZero OFT contracts finalized March 2026, covering 5 named contracts, 1 medium + 3 low findings, 'Secure' ratingWell supported; the source also mentions an additional QA-level finding the page omits, a minor simplification but not an inaccuracy. - #18[confirmed][no action needed]in section: Broader February 2026 Bridge Attack Wave
“The IoTeX ioTube bridge was exploited on February 21–22, 2026 for approximately $4.3–4.4 million via a compromised validator owner private key on the Ethereum side — a distinct operational security failure rather than a smart contract logic flaw.”
reviewerIoTeX ioTube bridge exploited Feb 21-22, 2026 for ~$4.3-4.4 million via compromised validator private keyWell supported. - #20[confirmed][no action needed]in section: Broader February 2026 Bridge Attack Wave
“PeckShield data through mid-May 2026 documented eight significant bridge-related incidents in 2026 with cumulative losses of approximately $328–329 million.”
reviewerPeckShield data through mid-May 2026 documented eight significant bridge-related incidents in 2026 with cumulative losses of approximately $328-329 millionDirectly confirmed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.