CrossCurve Bridge Exploited for $3M After Spoofed Cross-Chain Messages

• Attackers bypassed gateway validation using spoofed cross-chain messages to unlock funds.
• The exploit drained roughly $3 million from CrossCurve’s PortalV2 contract across multiple networks.
• CrossCurve identified ten recipient wallets and activated its 10% WhiteHat bounty policy.

CrossCurve, a decentralized cross-chain liquidity protocol formerly known as EYWA, has confirmed that its bridge infrastructure was exploited, leading to losses of about $3 million.

The attack adds to a substantial rise in crypto thefts. Nearly $400 million was stolen across the industry in January 2026 alone. More than 40 major security incidents were recorded during the month, according to CertiK. 

Spoofed Messages Bypassed Validation

The exploit targeted a missing validation check in one of CrossCurve’s smart contracts. According to Defimon Alerts, anyone could call the expres…

Read The Full Article CrossCurve Bridge Exploited for $3M After Spoofed Cross-Chain Messages On Coin Edition.