CrossCurve

CrossCurve receives a D+ risk grade (62/100) from Hindenrank, where lower scores indicate lower risk. High risk — already exploited for $3M through a basic validation bypass, and the multi-layer security model proved weaker than advertised A cross-chain bridge built specifically for Curve Finance pools, letting you swap stablecoins across blockchains. It raised $7M and processed $1.85B in its first year. Its D+ grade reflects a $3M hack in February 2026 caused by a missing security check that let anyone forge fake cross-chain messages.

The key risks identified for CrossCurve are: (1) In February 2026, a hacker sent fake messages that the bridge accepted as real, draining $3M. The same attack pattern could be repeated at larger scale on any chain where CrossCurve operates (2) The bridge claims to use three independent validation layers (Axelar, LayerZero, EYWA), but bypassing just one was enough to steal everything. The multi-layer security was false confidence (3) The team offered the hacker a 10% bounty to return the funds. If the hacker launders the money through mixers instead, there is no recovery plan

CrossCurve scores 62/100 across eight risk dimensions: Mechanism Novelty: 6/15, Interaction Severity: 20/20, Oracle Surface: 5/10, Documentation Gaps: 7/10, Track Record: 15/15, Scale Exposure: 0/10, Regulatory Risk: 4/10, Vitality Risk: 5/10. The highest risk area is Interaction Severity at 20/20.

Among 19 rated Bridge protocols on Hindenrank, CrossCurve ranks #19 by safety (lowest risk score = safest). Its 62/100 risk score and D+ grade place it among the riskier Bridge protocols.

CrossCurve scores 15/15 on the Track Record risk dimension, indicating some history of security incidents or exploits. Higher scores reflect more severe or frequent incidents. Review the full risk report for details.