Audit log

Every state-changing event for CrossCurve: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-27 19:45:49Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,568,343

   sig

   3SRAKVtzLW8C…TMKEc92ncopyexplorer ↗

   hash

   6tkbWUcWLHUW…8fP53o9Jcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6635 B) ▸

   {"actor":"system:backfill","investigation_id":"c18c86d7-2fb4-4de4-9c16-385555f1a0cb","kind":"publish","page_slug":"crosscurve","published_at":"2026-05-27T19:45:49.230Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"CrossCurve","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://crosscurve.fi/","type":"other","url":""},{"credibility":3,"name":"https://docs.eywa.fi/eywa-ecosystem/team","type":"other","url":""},{"credibility":3,"name":"https://tracxn.com/d/companies/crosscurve/__nGqUTPDbr5mzlOWCUZlCLLaznFYA806Qh481XLIQOY8","type":"other","url":""},{"credibility":3,"name":"https://crosscurve.medium.com/an-interview-with-eywa-ceo-boris-povar-92e21ae9ed07","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.globenewswire.com/news-release/2024/05/03/2875386/0/en/Top-VCs-Join-EYWA-s-Seed-Round-Led-by-Curve-Founder.html","type":"other","url":""},{"credibility":3,"name":"https://finance.yahoo.com/news/top-vcs-join-eywas-seed-213000700.html","type":"other","url":""},{"credibility":3,"name":"https://cryptorank.io/ico/eywa","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-crosscurve-hack-february-2026","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/cross-curve-exploit","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/crosscurve-bridge-exploit-loss/","type":"other","url":""},{"credibility":3,"name":"https://thecyberexpress.com/crosscurve-bridge-3m-cyberattack/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/02/02/crosscurve-suffers-3m-loss-in-cross-chain-bridge-breach/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/356599/crosscurve-legal-action-3m-cross-chain-bridge-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.thecoinrepublic.com/2026/02/02/crypto-hack-crosscurve-warns-users-to-halt-activity-as-bridge-comes-under-attack/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/single/crosscurve-users-exploited-for-around-3-million","type":"other","url":""},{"credibility":3,"name":"https://finance.yahoo.com/news/crosscurve-threatens-legal-action-3m-054416969.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.mexc.com/news/1028361","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-crosscurve-hack-february-2026","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coingecko.com/en/coins/eywa","type":"other","url":""},{"credibility":3,"name":"https://defillama-ui.vercel.app/protocol/crosscurve-(by-eywa)?denomination=USD","type":"other","url":""},{"credibility":3,"name":"https://cryptorank.io/price/eywa","type":"other","url":""},{"credibility":3,"name":"https://chainbroker.io/projects/crosscurve/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://en.wikipedia.org/wiki/ZachXBT","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/markets/crypto-traders-attempt-to-frontrun-zachxbt-s-upcoming-expose","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://dev.to/ohmygod/cross-chain-bridge-security-checklist-7-lessons-from-140m-in-bridge-exploits-2025-2026-5ap3","type":"other","url":""},{"credibility":3,"name":"https://www.ccn.com/news/crypto/crosscurve-bridge-exploit-3m-cross-chain-risk-hack/","type":"other","url":""}]}],"sources_used":[],"summary":"CrossCurve (formerly EYWA) is a cross-chain DeFi liquidity protocol built in partnership with Curve Finance, backed by $8.5 million in funding including a seed round led by Curve founder Michael Egorov. On February 1-2, 2026, the protocol suffered a critical smart contract exploit in its ReceiverAxelar bridge contract, resulting in an estimated $3 million in user losses across multiple chains; confirmed liquid losses were approximately $1.44 million after exchange freezes limited attacker liquidation. A subsequent Hashlock audit of separate OFT messaging contracts in March 2026 found and resolved additional vulnerabilities, and the protocol has not publicly confirmed full fund recovery from the February exploit.","timeline":[{"date":"2021-01-01","event":"EYWA protocol founded by Boris Povar, Faraj Abutalibov, and Peter Tagunov in Tortola, British Virgin Islands.","source":""},{"date":"2023-09-01","event":"Curve Finance founder Michael Egorov reportedly backs CrossCurve as an early investor.","source":""},{"date":"2024-05-03","event":"EYWA completes $7 million seed round led by Michael Egorov, with participation from Fenbushi Capital and GBV Capital.","source":""},{"date":"2024-12-21","event":"EYWA announces additional funding round with participation from 1inch co-founder Anton Bukov and Kenetic Fund, bringing total raised to approximately $8.5 million.","source":""},{"date":"2024-12-27","event":"EYWA token reaches all-time high of approximately $0.252.","source":""},{"date":"2026-01-31","event":"PortalV2 contract balance drops from approximately $3 million to near zero; exploit begins.","source":""},{"date":"2026-02-01","event":"CrossCurve confirms active bridge exploit across multiple networks; team pauses all contracts and warns users to halt activity.","source":""},{"date":"2026-02-02","event":"CEO Boris Povar identifies 10 Ethereum addresses receiving stolen funds, issues 72-hour ultimatum with 10% bounty offer, and threatens criminal referrals and civil litigation.","source":""},{"date":"2026-02-02","event":"XT Exchange freezes EYWA token deposits, preventing attacker liquidation of approximately 999.8 million minted EYWA tokens.","source":""},{"date":"2026-03-01","event":"CrossCurve commissions Hashlock audit of LayerZero OFT messaging contracts; audit concludes with 'Secure' rating after resolution of identified vulnerabilities.","source":""},{"date":"2026-03-25","event":"QuillAudits publishes post-mortem analysis confirming confirmed liquid losses of $1,441,892.31 from the February exploit.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 781ae5e1-7344-454c-a968-75fb22c24450copy
2. #2rescoreby systemsystem

   2026-10-10 18:47:14Z
   Score: 28 → 64 (+36)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 64. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +10, regulated +5.
   anchoranchored

   chain

   ●mainnet-betaslot 455,367,103

   sig

   3myRWtqgaMSR…BzGXkiY1copyexplorer ↗

   hash

   B58kkQsPNita…9rB4hp7Acopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (656 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:47:14.724Z","decision":"rescore","investigation_id":"c18c86d7-2fb4-4de4-9c16-385555f1a0cb","new_score":64,"page_slug":"crosscurve","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 64. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +10, regulated +5.","score_delta":36,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 30bdb0ab-497d-49bb-8b09-a5450ed38d1ecopy
3. #3rescoreby systemsystem

   2026-11-01 22:52:40Z
   Score: 64 → 67 (+3)
   Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 64 → 67. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −3.3; legitimacy credit long-running +10, regulated +5; the penalty for incidents it suffered is capped at 20.
   anchoranchored

   chain

   ●mainnet-betaslot 464,266,870

   sig

   7KHCLxwjch9b…LpRghd5Ycopyexplorer ↗

   hash

   ACfyQ6WmZH9P…6qrhjhzAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (743 B) ▸

   {"actor":"system","decided_at":"2026-11-01T22:52:39.931Z","decision":"rescore","investigation_id":"c18c86d7-2fb4-4de4-9c16-385555f1a0cb","new_score":67,"page_slug":"crosscurve","prev_score":64,"reason":"Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 64 → 67. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −3.3; legitimacy credit long-running +10, regulated +5; the penalty for incidents it suffered is capped at 20.","score_delta":3,"score_model":"v2","sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision dc77a93b-fe89-44e5-b397-49c7e5c16762copy
4. #4reviewby reviewerreviewer

   2026-11-01 22:54:05Z
   Score: 67 → 67 (no score change)
   The core narrative of the February 2026 bridge exploit (ReceiverAxelar access-control flaw, about $3M initially reported, about $1.4M liquid after an exchange froze minted EYWA, SafeHarbor 10% bounty) is supported by Halborn, QuillAudits and press coverage I fetched. Defects found: the QuillAudits post-mortem is dated 3 Feb 2026 but the timeline says March; the only source for the Hashlock audit now returns 410; a long chain list is not supported by the sources checked; and the page omits the later service restoration and old-bridge withdrawal mode. Several funding, TVL and aggregate-loss claims were not checked.
   anchoranchored

   chain

   ●mainnet-betaslot 464,267,306

   sig

   E3NJFbPjnVAY…GLbauGQ3copyexplorer ↗

   hash

   At1kkM64Eae9…EBS32Tg3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1468 B) ▸

   {"actor":"reviewer","artifact_identity":"59875ea48ab91b727e0afcd7635cdb0e","decided_at":"2026-11-01T22:54:05.067Z","decision":"review","disputed_pct":0.25,"findings_hash":"BQP5bjwwYzi9uLsdcowffhyPKY6PjaamAiuQtk7hUFi3","investigation_id":"c18c86d7-2fb4-4de4-9c16-385555f1a0cb","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":67,"omissions":{"material":1,"total":1},"page_content_hash":"22881686e67211e0bbaef330f248d771d69dd3c91266557f2e46db1871ab40c1","page_slug":"crosscurve","prev_score":67,"reason":"The core narrative of the February 2026 bridge exploit (ReceiverAxelar access-control flaw, about $3M initially reported, about $1.4M liquid after an exchange froze minted EYWA, SafeHarbor 10% bounty) is supported by Halborn, QuillAudits and press coverage I fetched. Defects found: the QuillAudits post-mortem is dated 3 Feb 2026 but the timeline says March; the only source for the Hashlock audit now returns 410; a long chain list is not supported by the sources checked; and the page omits the later service restoration and old-bridge withdrawal mode. Several funding, TVL and aggregate-loss claims were not checked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision bd15c2f5-2ade-4ce3-afdc-90a4522b0dd9copy
5. #5review reviseby judgejudge

   2026-11-01 22:54:05Z
   Score: 67 → 67 (no score change)
   Of 8 checked claims, 2 (25%) were disputed or unverifiable: the QuillAudits post-mortem is dated 3 February 2026 rather than March (claim_findings[0]), and the long list of affected chains could not be confirmed beyond Ethereum and Arbitrum (claim_findings[3]). The only source for the Hashlock audit claims now returns HTTP 410 (claim_findings[5] and [6]), which leaves those audit details without a live citation. The page also omits that CrossCurve later reactivated services and opened a withdrawal mode for the old bridge. The core account of the February 2026 exploit is supported by Halborn, QuillAudits and press coverage.
   anchoranchored

   chain

   ●mainnet-betaslot 464,267,311

   sig

   yEmiLwUa14wG…RMx8eo5Ccopyexplorer ↗

   hash

   C44QCYziSeL8…uqnia3mNcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1730 B) ▸

   {"actor":"judge","artifact_identity":"59875ea48ab91b727e0afcd7635cdb0e","band_override":null,"decided_at":"2026-11-01T22:54:05.067Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.25,"investigation_id":"c18c86d7-2fb4-4de4-9c16-385555f1a0cb","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":67,"page_slug":"crosscurve","prev_score":67,"reason":"Of 8 checked claims, 2 (25%) were disputed or unverifiable: the QuillAudits post-mortem is dated 3 February 2026 rather than March (claim_findings[0]), and the long list of affected chains could not be confirmed beyond Ethereum and Arbitrum (claim_findings[3]). The only source for the Hashlock audit claims now returns HTTP 410 (claim_findings[5] and [6]), which leaves those audit details without a live citation. The page also omits that CrossCurve later reactivated services and opened a withdrawal mode for the old bridge. The core account of the February 2026 exploit is supported by Halborn, QuillAudits and press coverage.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"severity_override":{"applied":false,"band":null,"from_band":"minor","reason":"The review reports one material omission (later service restoration and old-bridge withdrawal mode), but its only source is a low-tier aggregator feed with relative dates, and subject_status.contradicts_page is false because the page already says operations were suspended. The omission is handled as a requested text addition within the minor band rather than a harsher band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 81bebd27-0e43-495c-b2ea-1db2d3466888copy