CrossCurve Bridge Exploit Drains $3 Million in Multi-Chain Cyberattack CrossCurve, a cross-chain decentralized exchange and liquidity protocol formerly known as EYWA, suffered a major cyberattack on January 31 after attackers exploited a smart contract vulnerability, draining approximately $3 million across multiple blockchain networks. The CrossCurve team confirmed the incident on Sunday, urging users to halt all interactions with the protocol while investigations continued. The attack stemmed from a flaw in the ReceiverAxelar contract, which lacked a critical validation check, allowing threat actors to bypass gateway security using spoofed cross-chain messages. By calling the expressExecute function with forged data, attackers triggered unauthorized token unlocks via the PortalV2 contract, siphoning funds without proper authorization. Blockchain security firm Defimon Alerts identified the root cause, while Arkham Intelligence data revealed the PortalV2 contract’s balance plummeted from $3 million to near zero during the exploit. The attack spanned multiple chains, underscoring the risks of cross-chain messaging systems. CrossCurve, developed in partnership with Curve Finance, had marketed its "Consensus Bridge" which routes transactions through Axelar, LayerZero, and the EYWA Oracle Network as a security advantage, claiming the redundancy minimized failure risks. However, the breach demonstrated that a single vulnerable smart contract could compromise the entire system, regardless of layered validation. The protocol has significant backing in DeFi, including a $7 million venture capital raise and an investment from Curve Finance founder Michael Egorov in September 2023. Following the exploit, Curve Finance advised users with exposure to EYWA-related pools to review their positions. Security researchers noted parallels to the 2022 Nomad bridge hack, where a flawed validation mechanism led to a $190 million exploit, later replicated by copycat attackers. The CrossCurve incident reignites concerns over bridge security in decentralized finance.