What happened
On February 1, 2026, CrossCurve’s PortalV2 bridge contracts were exploited through spoofed cross-chain messages, with initial reporting estimating about $3 million extracted across multiple networks.
Technical root cause
CrossCurve exposed an unprotected Axelar expressExecute path that bypassed gateway message validation while relying on externally supplied source metadata for authorization.
How it happened
The attacker called ReceiverAxelar expressExecute with a forged payload, bypassed Axelar Gateway validation, and caused PortalV2 contracts to unlock assets on Ethereum and then Arbitrum.
Protocol details
Classification
Protocol Logic / Bridge / Bridge & Cross-Chain
Protocol Type
Cross Chain Bridge
Category
Bridge Hack
Protocol links
Website
@crosscurvefi
Security review history
- Hexens View report
- MixBytes View report
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
