CrossCurve DeFi Protocol Faces $3 Million Loss Due to Smart Contract Exploit

Cross-chain bridge CrossCurve announced on Monday that it has experienced a significant security breach, resulting in a loss of $3 million across various networks.

Key Takeaways

CrossCurve has lost $3 million due to a smart contract attack affecting multiple networks.
Users are urged to suspend all interactions with the platform regarding security vulnerabilities.
CrossCurve is offering a 10% bounty to white-hat hackers for fund recovery.
There is a 72-hour deadline for hackers to return the funds before further action is taken.
Industry experts suggest improvements in smart contract security standards to prevent such incidents.

CrossCurve exploit

The decentralized finance (DeFi) protocol revealed that a weakness in its smart contracts had been compromised, raising serious concerns about the security within cross-chain infrastructures.

“Our bridge is currently under attack,” the platform stated on X, urging users to refrain from any interactions with CrossCurve.

Understanding the Smart Contract Vulnerability

According to a post from CrossCurve, several user addresses received tokens as a result of this smart contract flaw, which were “wrongfully taken” from other users.

“We do not believe this was intentional on your part, and there is no indication of malicious intent. We hope for your cooperation in returning the funds,” the platform informed, pointing out a total of ten affected addresses.

Blockchain security account Defimon Alerts reported that a vulnerability in CrossCurve’s ReceiverAxelar smart contract allowed anyone to spoof cross-chain messages, thereby bypassing the necessary gateway validation. This loophole led to unauthorized token unlocks on the PortalV2 contract.

In a related note, Curve Finance suggested that users who have cast votes in platform-related pools “should consider reviewing their positions and potentially retracting those votes.”

Notably, CrossCurve is supported by Curve Finance founder Michael Egorov and had successfully raised $7 million from venture capitalists in 2023.

CrossCurve's Response: Bounty Offer and Time Limit

Under the Safe Harbor Responsible Disclosure Policy, which outlines the procedure for responsibly reporting security vulnerabilities, CrossCurve has announced that a 10% bounty will be awarded to any white-hat hacker who assists in recovering the lost funds.

“This makes you eligible to keep up to 10% if the remainder is returned,” the project team explained.

In addition, CrossCurve has introduced a 72-hour window for hackers to return the funds. If there isn’t effective communication within this timeframe, the project team plans to escalate the matter.

This escalation includes pursuing formal criminal and civil actions while collaborating with major exchanges such as Coinbase and Binance, stablecoin issuers, law enforcement, and on-chain analytics firms like Chainalysis, TRM Labs, and Elliptic.

The CrossCurve hack bears resemblance to the Nomad hack of 2022, which saw a shocking $190 million lost and compromised around 8,000 Solana wallets.

Andrew Morfill, Chief Information Security Officer at Komainu, stated to Cryptonews, “To prevent incidents like this, the industry should adopt a standard set of secure smart contract templates, conduct regular audits, and implement secure software development lifecycles. As the market matures, protocols designed and maintained with security will gain the credibility and trust that investors are seeking.”