Incident Overview
On February 1, 2026, CrossCurve bridge suffered a ~$2.9M exploit across multiple chains when an attacker exploited an authorization bypass vulnerability in the ReceiverAxelar contract.
The vulnerability existed in the ReceiverAxelar contract's expressExecute() function, which bypassed Axelar's intended security model. In the proper flow, cross-chain messages must be approved by the Axelar Gateway and validated via validateContractCall(), binding specific parameters to authorized execution. However, expressExecute() skipped this validation entirely and relied only on peer checks using attacker-controlled sourceChain and sourceAddress parameters.
The attacker exploited this by submitting spoofed messages, taking the receiveData branch, and executing arbitrary payloads that triggered unlock() on the Eywa CLP Portal, releasing cross-chain assets without authorization. The team discovered an additional $140,762 stolen via bot-driven attacks during investigation, bringing total losses to approximately $2.9M. CrossCurve issued a 72-hour ultimatum to addresses holding exploited funds, offering 10% bounty under SafeHarbor WhiteHat policy for returns, threatening legal action, exchange freezes, and law enforcement collaboration if funds aren't returned.
Addresses Holding Exploited Funds:
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to CrossCurve, these are the critical security checks that could have prevented this incident (February 2026).
- Verify all logic paths related to Spoofed Cross-Chain Messages / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
- 01
- 02
- 03
Learn to Prevent the Next CrossCurve
The CrossCurve hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.