How Does CrossCurve Work?
A cross-chain bridge built specifically for Curve Finance pools, letting you swap stablecoins across blockchains. It raised $7M and processed $1.85B in its first year. Its D+ grade reflects a $3M hack in February 2026 caused by a missing security check that let anyone forge fake cross-chain messages.
TVL
—
Sector
Bridge
Risk Grade
D+
Value Grade
D-
Core Mechanisms
8.1.3
NovelConsensus Bridge: cross-chain messages validated through Axelar, LayerZero, and EYWA Oracle Network in parallel
CrossCurve routes cross-chain transactions through multiple independent validation protocols to reduce single points of failure. However, the February 2026 exploit showed that a bypass in just the Axelar pathway (ReceiverAxelar.expressExecute) was sufficient to drain funds.
8.1.1
PortalV2: lock-and-mint bridge contract holding cross-chain liquidity across Ethereum, Arbitrum, Optimism, BSC, Polygon
Standard lock-and-mint pattern where tokens are locked on the source chain and minted/unlocked on the destination. PortalV2 was the contract drained from ~$3M to near zero in the exploit.
4.1.3
NovelCross-chain Curve pool access: routes swaps through Curve's stableswap pools across multiple chains
CrossCurve provides seamless access to Curve Finance pools across chains, tapping into $2.7B+ of Curve TVL. Novel cross-chain DEX aggregation pattern built specifically for Curve ecosystem.
8.4.2
NovelEYWA Oracle Network: proprietary oracle validators providing cross-chain state proofs
CrossCurve operates its own oracle network (inherited from EYWA Protocol rebrand) alongside Axelar and LayerZero. Custom oracle with smaller validator set than established networks.
8.4.1
Relayer fee model for cross-chain message delivery across supported chains
Standard relayer-based fee model for delivering cross-chain messages. Relayers are paid per message to facilitate bridge operations.
2.1.2
Percentage-based bridge fees on cross-chain swap volume ($1.85B annual volume)
Standard percentage fee on each cross-chain swap. Protocol generated revenue from $1.85B in trading volume in its first year.
Yield/LP-Rewards
Cross-chain yield farming: LP rewards for providing liquidity in CrossCurve-connected Curve pools
LPs earn yield from both Curve pool fees and CrossCurve bridge fees. Liquidity mining incentives to attract cross-chain liquidity providers.
How the Pieces Interact
The expressExecute function in ReceiverAxelar allowed anyone to call it with a spoofed cross-chain message, bypassing the intended Axelar gateway validation. This triggered unauthorized token unlocks on PortalV2, draining $3M across multiple chains in February 2026.
Despite routing through three independent validation layers (Axelar, LayerZero, EYWA Oracle), a validation bypass in just the Axelar pathway was sufficient to drain funds. The 'consensus' model provided false security because each pathway could independently authorize unlocks.
CrossCurve pools are connected to Curve Finance's $2.7B TVL. A bridge exploit that manipulates token balances across chains could create imbalanced Curve pools, causing impermanent loss for uninvolved LPs in connected Curve pools.
CrossCurve depends on three separate oracle/messaging networks with different security models and trust assumptions. A compromise of any single network is sufficient to forge messages, and coordinating security patches across three protocols is operationally complex.
The 10% bounty offered post-exploit relies on attacker cooperation. If the attacker launders funds through mixers (as commonly occurs), the protocol has no recovery mechanism. The CEO identified 10 Ethereum addresses but has no enforcement power.
What Could Go Wrong
- Exploited for $3M in February 2026 via spoofed cross-chain messages bypassing gateway validation in the ReceiverAxelar contract
- Multi-validator consensus bridge (Axelar + LayerZero + EYWA Oracle) had a missing validation check that allowed unauthorized token unlocks from PortalV2
- Cross-chain message validation is inherently complex; the protocol routes through three independent validation layers but a single bypass in one layer was sufficient to drain funds
Consensus Bridge Validator Collusion
ModerateTrigger: Attackers compromise or collude with a sufficient subset of CrossCurve's multi-validator consensus bridge (Axelar + LayerZero + EYWA Oracle) to forge cross-chain messages at will
- 1.Attacker identifies that the ReceiverAxelar contract's expressExecute function can be called with spoofed messages that bypass gateway validation (as demonstrated in Feb 2026 exploit) — Unauthorized token unlocks drain the PortalV2 contract across multiple chains simultaneously
- 2.Exploited validation bypass is replicated across all chains where CrossCurve operates (Ethereum, Arbitrum, Optimism, BSC, Polygon) — Total protocol TVL is drained as the same exploit pattern works on each chain's PortalV2 deployment
- 3.Curve Finance liquidity pools integrated with CrossCurve face imbalance as exploited tokens are dumped — Contagion spreads to Curve pools with $2.7B TVL; LPs in CrossCurve-connected pools face significant impermanent loss
Risk Profile at a Glance
Overall: D+ (62/100)
Lower score = safer