<p><img src="https://imageproxy.pbkrs.com/https://invezz.com/wp-content/uploads/2026/02/20260202_1446_Image-Generation_simple_compose_01kget7hmbf57tfe5r0j9zvsdh.png?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg" alt="" width="1536" height="1024" original-src="https://imageproxy.pbkrs.com/https://invezz.com/wp-content/uploads/2026/02/20260202_1446_Image-Generation_simple_compose_01kget7hmbf57tfe5r0j9zvsdh.png"/></p>
<p>去中心化金融协议 CrossCurve 已经识别出十个参与其桥接基础设施漏洞的以太坊钱包地址。</p>
<p>非官方估计称，可能已经损失近 300 万美元的资金。</p>
<p>此次事件发生在周日，涉及 CrossCurve 的一个智能合约中的漏洞，该合约是其跨链桥接基础设施的一部分，旨在实现不同链之间的代币转移。</p>
<p>此次漏洞影响了多个网络，CrossCurve 已敦促用户在问题修复之前避免与该协议互动。</p>
<p><img src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/profile_images/1930196711290372096/tjNXrPW-_normal.jpg?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg" alt="" width="48" height="48" original-src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/profile_images/1930196711290372096/tjNXrPW-_normal.jpg"/></p>
<p>⚠️ 紧急安全通知亲爱的用户，我们的桥接目前正遭受攻击，涉及利用一个智能合约中的漏洞进行攻击。请在调查进行期间暂停与 CrossCurve 的所有互动。感谢您的耐心等待。</p>
<p><img src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/media/HAGZ3naWwAAMO2W/query-Zm9ybWF0PWpwZyZuYW1lPXNtYWxs?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg" alt="" width="680" height="454" original-src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/media/HAGZ3naWwAAMO2W/query-Zm9ybWF0PWpwZyZuYW1lPXNtYWxs"/></p>
<p>2026 年 2 月 2 日上午 2:15</p>
<p>阅读 16 条回复</p>
<p>值得注意的是，攻击者利用智能合约漏洞绕过消息验证，触发未经授权的资金释放。</p>
<p>此次事件的正式事后分析报告尚未发布。</p>
<p>由 Decurity 运营的区块链安全追踪器 Defimon Alerts 推测，该漏洞可能源于 CrossCurve 的 ReceiverAxelar 合约中的不当验证逻辑。</p>
<p>他们的分析表明，该合约的 expressExecute 函数可能会被 “伪造” 的跨链消息触发，从而绕过通常确保消息合法性的网关认证过程。</p>
<p>由于这一漏洞，攻击者能够模拟有效的跨链通信，并在没有适当验证的情况下从协议的 PortalV2 合约中解锁代币，并在多个网络上从桥接合约中提取资金，而无需在源链上存入相应的资产。</p>
<p>区块链安全公司初步估计总损失约为 300 万美元。</p>
<p>网络安全公司 BlockSec 将总损失估计为约 276 万美元，其中大约 130 万美元来自以太坊，128 万美元来自 Arbitrum。</p>
<p>在其他多个链上也有小额资金被提取，包括 Optimism、Base、Mantle、Kava、Frax、Celo 和 Blast。</p>
<p>截至撰写本文时，CrossCurve 尚未确认这些外部估计或披露其自身对受影响资金的计算。</p>
<h2>CrossCurve 提供 10% 悬赏</h2>
<p>在一份公开声明中，CrossCurve 首席执行官 Boris Povar 表示，团队已追踪到被盗资产的流动到十个特定的以太坊地址。</p>
<p>他指出，由于智能合约缺陷，代币被盗，并呼吁接收者归还资金，表示 “没有恶意意图的迹象”。</p>
<p>“如果资金在 72 小时内未归还或未建立联系，我们将不得不假设存在恶意意图，并将此视为司法事务，” Povar 说。</p>
<p>Povar 补充说，如果在规定的截止日期内归还资金，项目将提供 10% 的悬赏。</p>
<p>CrossCurve 之前曾将其多层共识桥接架构宣传为防范跨链系统中典型单点故障的保障。</p>
<p>其验证堆栈包括与 Axelar 和 LayerZero 等网络的集成，以及其专有的 EYWA Oracle Network。</p>
<p>在过去的文档中，CrossCurve 团队曾声称 “多个跨链协议同时被黑客攻击的概率接近于零。”</p>
<p>此次最新的漏洞也引发了与 2022 年 Nomad Bridge 漏洞的比较，该漏洞暴露了验证逻辑中的类似漏洞。</p>
<p>当时，智能合约升级中的编码失误使用户能够复制和粘贴交易，导致近 1.9 亿美元的资金在涉及超过 300 个独特地址的抢劫中被盗。</p>
<p>文章《CrossCurve 识别出参与 300 万美元桥接漏洞的 10 个钱包》首次出现在 Invezz 上。</p>

<p>CrossCurve 已经识别出十个与其桥接基础设施的 300 万美元漏洞相关的以太坊钱包，该基础设施因智能合约漏洞而受到影响。此次 breach 使攻击者能够在多个网络中提取资金。CrossCurve 已敦促用户暂停与该协议的互动，并提供 10% 的赏金以换取被盗资产的归还。该事件引发了与之前漏洞的比较，突显了跨链系统的脆弱性。正式的事后分析尚未发布，公司也未确认外部损失估计</p>

<p><img src="https://imageproxy.pbkrs.com/https://invezz.com/wp-content/uploads/2026/02/20260202_1446_Image-Generation_simple_compose_01kget7hmbf57tfe5r0j9zvsdh.png" alt="" original-src="https://invezz.com/wp-content/uploads/2026/02/20260202_1446_Image-Generation_simple_compose_01kget7hmbf57tfe5r0j9zvsdh.png"/></p>
<p>Decentralised finance protocol CrossCurve has identified ten Ethereum wallet addresses involved in the exploit of its bridge infrastructure.</p>
<div class="lb-trans"><p>去中心化金融协议 CrossCurve 已经识别出十个参与其桥接基础设施漏洞的以太坊钱包地址。</p>
</div><p>Unofficial estimates claim nearly $3 million worth of funds may have been drained.</p>
<div class="lb-trans"><p>非官方估计称，可能已经损失近 300 万美元的资金。</p>
</div><p>The incident, which occurred on Sunday, involved a vulnerability in one of CrossCurve’s smart contracts that forms part of its cross-chain bridge infrastructure, which is designed to enable token transfers between different chains.</p>
<div class="lb-trans"><p>此次事件发生在周日，涉及 CrossCurve 的一个智能合约中的漏洞，该合约是其跨链桥接基础设施的一部分，旨在实现不同链之间的代币转移。</p>
</div><p>The breach has impacted several networks, and CrossCurve has urged users to avoid interacting with the protocol until the issue has been patched.</p>
<div class="lb-trans"><p>此次漏洞影响了多个网络，CrossCurve 已敦促用户在问题修复之前避免与该协议互动。</p>
</div><p><img src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/profile_images/1930196711290372096/tjNXrPW-_normal.jpg" alt="" original-src="https://pbs.twimg.com/profile_images/1930196711290372096/tjNXrPW-_normal.jpg"/></p>
<p>⚠️ URGENT Security NoticeDear users,Our bridge is currently under attack, involving the exploitation of a vulnerability in one of the smart contracts used.Please pause all interactions with CrossCurve while the investigation is ongoing.We appreciate your patience and</p>
<div class="lb-trans"><p>⚠️ 紧急安全通知亲爱的用户，我们的桥接目前正遭受攻击，涉及利用一个智能合约中的漏洞进行攻击。请在调查进行期间暂停与 CrossCurve 的所有互动。感谢您的耐心等待。</p>
</div><p><img src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/media/HAGZ3naWwAAMO2W/query-Zm9ybWF0PWpwZyZuYW1lPXNtYWxs" alt="" original-src="https://pbs.twimg.com/media/HAGZ3naWwAAMO2W?format=jpg&amp;name=small"/></p>
<p>2:15 AM · Feb 2, 2026</p>
<div class="lb-trans"><p>2026 年 2 月 2 日上午 2:15</p>
</div><p>Read 16 replies</p>
<div class="lb-trans"><p>阅读 16 条回复</p>
</div><p>Notably, an attacker leveraged a smart contract vulnerability to bypass message validation and trigger unauthorised fund releases.</p>
<div class="lb-trans"><p>值得注意的是，攻击者利用智能合约漏洞绕过消息验证，触发未经授权的资金释放。</p>
</div><p>A formal post-mortem of the incident has also not yet been published.</p>
<div class="lb-trans"><p>此次事件的正式事后分析报告尚未发布。</p>
</div><p>Defimon Alerts, a blockchain security tracker operated by Decurity, speculated that the vulnerability may have stemmed from improper validation logic in CrossCurve’s ReceiverAxelar contract.</p>
<div class="lb-trans"><p>由 Decurity 运营的区块链安全追踪器 Defimon Alerts 推测，该漏洞可能源于 CrossCurve 的 ReceiverAxelar 合约中的不当验证逻辑。</p>
</div><p>Their analysis suggests that the contract’s expressExecute function could be triggered with “spoofed” cross-chain messages, bypassing the gateway authentication process that typically ensures message legitimacy.</p>
<div class="lb-trans"><p>他们的分析表明，该合约的 expressExecute 函数可能会被 “伪造” 的跨链消息触发，从而绕过通常确保消息合法性的网关认证过程。</p>
</div><p>As a result of this vulnerability, the attackers were able to simulate valid cross-chain communication and unlock tokens from the protocol’s PortalV2 contract without proper verification and withdraw funds from the bridge contract across multiple networks without depositing corresponding assets on the source chain.</p>
<div class="lb-trans"><p>由于这一漏洞，攻击者能够模拟有效的跨链通信，并在没有适当验证的情况下从协议的 PortalV2 合约中解锁代币，并在多个网络上从桥接合约中提取资金，而无需在源链上存入相应的资产。</p>
</div><p>Initial estimates from blockchain security firms place the total loss at around $3 million.</p>
<div class="lb-trans"><p>区块链安全公司初步估计总损失约为 300 万美元。</p>
</div><p>Cybersecurity firm BlockSec pegged total losses at approximately $2.76 million, with roughly $1.3 million taken from Ethereum and $1.28 million from Arbitrum.</p>
<div class="lb-trans"><p>网络安全公司 BlockSec 将总损失估计为约 276 万美元，其中大约 130 万美元来自以太坊，128 万美元来自 Arbitrum。</p>
</div><p>Smaller amounts were drained across a range of other chains, including Optimism, Base, Mantle, Kava, Frax, Celo, and Blast.</p>
<div class="lb-trans"><p>在其他多个链上也有小额资金被提取，包括 Optimism、Base、Mantle、Kava、Frax、Celo 和 Blast。</p>
</div><p>At the time of writing, CrossCurve has not confirmed these external estimates or disclosed its own calculation of the affected funds.</p>
<div class="lb-trans"><p>截至撰写本文时，CrossCurve 尚未确认这些外部估计或披露其自身对受影响资金的计算。</p>
</div><h2>CrossCurve offers 10% bounty</h2>
<div class="lb-trans"><h2>CrossCurve 提供 10% 悬赏</h2>
</div><p>In a public statement, CrossCurve CEO Boris Povar said the team had traced the movement of stolen assets to ten specific Ethereum addresses.</p>
<div class="lb-trans"><p>在一份公开声明中，CrossCurve 首席执行官 Boris Povar 表示，团队已追踪到被盗资产的流动到十个特定的以太坊地址。</p>
</div><p>He noted that the tokens were taken due to a smart contract flaw and appealed to the recipients to return the funds, stating that there was “no indication of malicious intent.”</p>
<div class="lb-trans"><p>他指出，由于智能合约缺陷，代币被盗，并呼吁接收者归还资金，表示 “没有恶意意图的迹象”。</p>
</div><p>“If the funds are not returned or no contact is established within 72 hours, we will have to assume malicious intent and treat this as a judicial matter,” Povar said.</p>
<div class="lb-trans"><p>“如果资金在 72 小时内未归还或未建立联系，我们将不得不假设存在恶意意图，并将此视为司法事务，” Povar 说。</p>
</div><p>The project will offer a 10% bounty if funds are returned within the given deadline, Povar added.</p>
<div class="lb-trans"><p>Povar 补充说，如果在规定的截止日期内归还资金，项目将提供 10% 的悬赏。</p>
</div><p>CrossCurve has previously marketed its multi-layered consensus bridge architecture as a safeguard against typical single points of failure in cross-chain systems.</p>
<div class="lb-trans"><p>CrossCurve 之前曾将其多层共识桥接架构宣传为防范跨链系统中典型单点故障的保障。</p>
</div><p>Its validation stack includes integrations with networks such as Axelar and LayerZero alongside its proprietary EYWA Oracle Network.</p>
<div class="lb-trans"><p>其验证堆栈包括与 Axelar 和 LayerZero 等网络的集成，以及其专有的 EYWA Oracle Network。</p>
</div><p>In past documentation, the CrossCurve team has claimed that “the probability of several crosschain protocols getting hacked at the same time is near zero.”</p>
<div class="lb-trans"><p>在过去的文档中，CrossCurve 团队曾声称 “多个跨链协议同时被黑客攻击的概率接近于零。”</p>
</div><p>The latest breach has also drawn comparisons to the 2022 Nomad Bridge exploit, which exposed similar vulnerabilities in validation logic.</p>
<div class="lb-trans"><p>此次最新的漏洞也引发了与 2022 年 Nomad Bridge 漏洞的比较，该漏洞暴露了验证逻辑中的类似漏洞。</p>
</div><p>At the time, a coding oversight in smart contract upgrades allowed users to copy and paste transactions to drain nearly $190 million in a free-for-all heist involving over 300 unique addresses.</p>
<div class="lb-trans"><p>当时，智能合约升级中的编码失误使用户能够复制和粘贴交易，导致近 1.9 亿美元的资金在涉及超过 300 个独特地址的抢劫中被盗。</p>
</div><p>The post CrossCurve identifies 10 wallets involved in the $3M bridge exploit appeared first on Invezz</p>
<div class="lb-trans"><p>文章《CrossCurve 识别出参与 300 万美元桥接漏洞的 10 个钱包》首次出现在 Invezz 上。</p>
</div>

CrossCurve identifies 10 wallets involved in the $3M bridge exploit

- CrossCurve 识别出 10 个以太坊钱包地址，涉及 300 万美元的桥接漏洞盗窃事件。  
- 攻击者利用智能合约漏洞，绕过消息验证发布资金。  
- CrossCurve 已呼吁用户暂停与协议的互动，调查仍在进行中。

CrossCurve 识别出与 300 万美元桥接漏洞相关的 10 个钱包