Cross-chain liquidity protocol CrossCurve was attacked due to a smart contract vulnerability, resulting in theft of approximately $3 million.

PANews February 2 News, according to The Block, the cross-chain liquidity protocol CrossCurve (formerly EYWA) confirmed that its cross-chain bridge protocol “is under attack” due to a vulnerability in its smart contract being exploited, resulting in approximately $3 million stolen across multiple networks. Blockchain security firm Defimon Alerts discovered that the attack vector was a gateway verification bypass vulnerability in CrossCurve’s ReceiverAxelar contract. Analysis shows that anyone can use forged cross-chain messages to call the expressExecute function of this contract, thereby bypassing the expected gateway verification and triggering unauthorized token unlocks on the protocol’s PortalV2 contract. The protocol is supported by Curve Finance founder Michael Egorov and has previously raised $7 million.