<p><img src="https://imageproxy.pbkrs.com/https://invezz.com/wp-content/uploads/2026/02/20260202_1446_Image-Generation_simple_compose_01kget7hmbf57tfe5r0j9zvsdh.png?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg" alt="" width="1536" height="1024" original-src="https://imageproxy.pbkrs.com/https://invezz.com/wp-content/uploads/2026/02/20260202_1446_Image-Generation_simple_compose_01kget7hmbf57tfe5r0j9zvsdh.png"/></p>
<p>去中心化金融協議 CrossCurve 已經識別出十個參與其橋接基礎設施漏洞的以太坊錢包地址。</p>
<p>非官方估計稱，可能已經損失近 300 萬美元的資金。</p>
<p>此次事件發生在週日，涉及 CrossCurve 的一個智能合約中的漏洞，該合約是其跨鏈橋接基礎設施的一部分，旨在實現不同鏈之間的代幣轉移。</p>
<p>此次漏洞影響了多個網絡，CrossCurve 已敦促用户在問題修復之前避免與該協議互動。</p>
<p><img src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/profile_images/1930196711290372096/tjNXrPW-_normal.jpg?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg" alt="" width="48" height="48" original-src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/profile_images/1930196711290372096/tjNXrPW-_normal.jpg"/></p>
<p>⚠️ 緊急安全通知親愛的用户，我們的橋接目前正遭受攻擊，涉及利用一個智能合約中的漏洞進行攻擊。請在調查進行期間暫停與 CrossCurve 的所有互動。感謝您的耐心等待。</p>
<p><img src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/media/HAGZ3naWwAAMO2W/query-Zm9ybWF0PWpwZyZuYW1lPXNtYWxs?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg" alt="" width="680" height="454" original-src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/media/HAGZ3naWwAAMO2W/query-Zm9ybWF0PWpwZyZuYW1lPXNtYWxs"/></p>
<p>2026 年 2 月 2 日上午 2:15</p>
<p>閲讀 16 條回覆</p>
<p>值得注意的是，攻擊者利用智能合約漏洞繞過消息驗證，觸發未經授權的資金釋放。</p>
<p>此次事件的正式事後分析報告尚未發佈。</p>
<p>由 Decurity 運營的區塊鏈安全追蹤器 Defimon Alerts 推測，該漏洞可能源於 CrossCurve 的 ReceiverAxelar 合約中的不當驗證邏輯。</p>
<p>他們的分析表明，該合約的 expressExecute 函數可能會被 “偽造” 的跨鏈消息觸發，從而繞過通常確保消息合法性的網關認證過程。</p>
<p>由於這一漏洞，攻擊者能夠模擬有效的跨鏈通信，並在沒有適當驗證的情況下從協議的 PortalV2 合約中解鎖代幣，並在多個網絡上從橋接合約中提取資金，而無需在源鏈上存入相應的資產。</p>
<p>區塊鏈安全公司初步估計總損失約為 300 萬美元。</p>
<p>網絡安全公司 BlockSec 將總損失估計為約 276 萬美元，其中大約 130 萬美元來自以太坊，128 萬美元來自 Arbitrum。</p>
<p>在其他多個鏈上也有小額資金被提取，包括 Optimism、Base、Mantle、Kava、Frax、Celo 和 Blast。</p>
<p>截至撰寫本文時，CrossCurve 尚未確認這些外部估計或披露其自身對受影響資金的計算。</p>
<h2>CrossCurve 提供 10% 懸賞</h2>
<p>在一份公開聲明中，CrossCurve 首席執行官 Boris Povar 表示，團隊已追蹤到被盜資產的流動到十個特定的以太坊地址。</p>
<p>他指出，由於智能合約缺陷，代幣被盜，並呼籲接收者歸還資金，表示 “沒有惡意意圖的跡象”。</p>
<p>“如果資金在 72 小時內未歸還或未建立聯繫，我們將不得不假設存在惡意意圖，並將此視為司法事務，” Povar 説。</p>
<p>Povar 補充説，如果在規定的截止日期內歸還資金，項目將提供 10% 的懸賞。</p>
<p>CrossCurve 之前曾將其多層共識橋接架構宣傳為防範跨鏈系統中典型單點故障的保障。</p>
<p>其驗證堆棧包括與 Axelar 和 LayerZero 等網絡的集成，以及其專有的 EYWA Oracle Network。</p>
<p>在過去的文檔中，CrossCurve 團隊曾聲稱 “多個跨鏈協議同時被黑客攻擊的概率接近於零。”</p>
<p>此次最新的漏洞也引發了與 2022 年 Nomad Bridge 漏洞的比較，該漏洞暴露了驗證邏輯中的類似漏洞。</p>
<p>當時，智能合約升級中的編碼失誤使用户能夠複製和粘貼交易，導致近 1.9 億美元的資金在涉及超過 300 個獨特地址的搶劫中被盜。</p>
<p>文章《CrossCurve 識別出參與 300 萬美元橋接漏洞的 10 個錢包》首次出現在 Invezz 上。</p>

<p>CrossCurve 已經識別出十個與其橋接基礎設施的 300 萬美元漏洞相關的以太坊錢包，該基礎設施因智能合約漏洞而受到影響。此次 breach 使攻擊者能夠在多個網絡中提取資金。CrossCurve 已敦促用户暫停與該協議的互動，並提供 10% 的賞金以換取被盜資產的歸還。該事件引發了與之前漏洞的比較，突顯了跨鏈系統的脆弱性。正式的事後分析尚未發佈，公司也未確認外部損失估計</p>

<p><img src="https://imageproxy.pbkrs.com/https://invezz.com/wp-content/uploads/2026/02/20260202_1446_Image-Generation_simple_compose_01kget7hmbf57tfe5r0j9zvsdh.png" alt="" original-src="https://invezz.com/wp-content/uploads/2026/02/20260202_1446_Image-Generation_simple_compose_01kget7hmbf57tfe5r0j9zvsdh.png"/></p>
<p>Decentralised finance protocol CrossCurve has identified ten Ethereum wallet addresses involved in the exploit of its bridge infrastructure.</p>
<div class="lb-trans"><p>去中心化金融協議 CrossCurve 已經識別出十個參與其橋接基礎設施漏洞的以太坊錢包地址。</p>
</div><p>Unofficial estimates claim nearly $3 million worth of funds may have been drained.</p>
<div class="lb-trans"><p>非官方估計稱，可能已經損失近 300 萬美元的資金。</p>
</div><p>The incident, which occurred on Sunday, involved a vulnerability in one of CrossCurve’s smart contracts that forms part of its cross-chain bridge infrastructure, which is designed to enable token transfers between different chains.</p>
<div class="lb-trans"><p>此次事件發生在週日，涉及 CrossCurve 的一個智能合約中的漏洞，該合約是其跨鏈橋接基礎設施的一部分，旨在實現不同鏈之間的代幣轉移。</p>
</div><p>The breach has impacted several networks, and CrossCurve has urged users to avoid interacting with the protocol until the issue has been patched.</p>
<div class="lb-trans"><p>此次漏洞影響了多個網絡，CrossCurve 已敦促用户在問題修復之前避免與該協議互動。</p>
</div><p><img src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/profile_images/1930196711290372096/tjNXrPW-_normal.jpg" alt="" original-src="https://pbs.twimg.com/profile_images/1930196711290372096/tjNXrPW-_normal.jpg"/></p>
<p>⚠️ URGENT Security NoticeDear users,Our bridge is currently under attack, involving the exploitation of a vulnerability in one of the smart contracts used.Please pause all interactions with CrossCurve while the investigation is ongoing.We appreciate your patience and</p>
<div class="lb-trans"><p>⚠️ 緊急安全通知親愛的用户，我們的橋接目前正遭受攻擊，涉及利用一個智能合約中的漏洞進行攻擊。請在調查進行期間暫停與 CrossCurve 的所有互動。感謝您的耐心等待。</p>
</div><p><img src="https://imageproxy.pbkrs.com/https://pbs.twimg.com/media/HAGZ3naWwAAMO2W/query-Zm9ybWF0PWpwZyZuYW1lPXNtYWxs" alt="" original-src="https://pbs.twimg.com/media/HAGZ3naWwAAMO2W?format=jpg&amp;name=small"/></p>
<p>2:15 AM · Feb 2, 2026</p>
<div class="lb-trans"><p>2026 年 2 月 2 日上午 2:15</p>
</div><p>Read 16 replies</p>
<div class="lb-trans"><p>閲讀 16 條回覆</p>
</div><p>Notably, an attacker leveraged a smart contract vulnerability to bypass message validation and trigger unauthorised fund releases.</p>
<div class="lb-trans"><p>值得注意的是，攻擊者利用智能合約漏洞繞過消息驗證，觸發未經授權的資金釋放。</p>
</div><p>A formal post-mortem of the incident has also not yet been published.</p>
<div class="lb-trans"><p>此次事件的正式事後分析報告尚未發佈。</p>
</div><p>Defimon Alerts, a blockchain security tracker operated by Decurity, speculated that the vulnerability may have stemmed from improper validation logic in CrossCurve’s ReceiverAxelar contract.</p>
<div class="lb-trans"><p>由 Decurity 運營的區塊鏈安全追蹤器 Defimon Alerts 推測，該漏洞可能源於 CrossCurve 的 ReceiverAxelar 合約中的不當驗證邏輯。</p>
</div><p>Their analysis suggests that the contract’s expressExecute function could be triggered with “spoofed” cross-chain messages, bypassing the gateway authentication process that typically ensures message legitimacy.</p>
<div class="lb-trans"><p>他們的分析表明，該合約的 expressExecute 函數可能會被 “偽造” 的跨鏈消息觸發，從而繞過通常確保消息合法性的網關認證過程。</p>
</div><p>As a result of this vulnerability, the attackers were able to simulate valid cross-chain communication and unlock tokens from the protocol’s PortalV2 contract without proper verification and withdraw funds from the bridge contract across multiple networks without depositing corresponding assets on the source chain.</p>
<div class="lb-trans"><p>由於這一漏洞，攻擊者能夠模擬有效的跨鏈通信，並在沒有適當驗證的情況下從協議的 PortalV2 合約中解鎖代幣，並在多個網絡上從橋接合約中提取資金，而無需在源鏈上存入相應的資產。</p>
</div><p>Initial estimates from blockchain security firms place the total loss at around $3 million.</p>
<div class="lb-trans"><p>區塊鏈安全公司初步估計總損失約為 300 萬美元。</p>
</div><p>Cybersecurity firm BlockSec pegged total losses at approximately $2.76 million, with roughly $1.3 million taken from Ethereum and $1.28 million from Arbitrum.</p>
<div class="lb-trans"><p>網絡安全公司 BlockSec 將總損失估計為約 276 萬美元，其中大約 130 萬美元來自以太坊，128 萬美元來自 Arbitrum。</p>
</div><p>Smaller amounts were drained across a range of other chains, including Optimism, Base, Mantle, Kava, Frax, Celo, and Blast.</p>
<div class="lb-trans"><p>在其他多個鏈上也有小額資金被提取，包括 Optimism、Base、Mantle、Kava、Frax、Celo 和 Blast。</p>
</div><p>At the time of writing, CrossCurve has not confirmed these external estimates or disclosed its own calculation of the affected funds.</p>
<div class="lb-trans"><p>截至撰寫本文時，CrossCurve 尚未確認這些外部估計或披露其自身對受影響資金的計算。</p>
</div><h2>CrossCurve offers 10% bounty</h2>
<div class="lb-trans"><h2>CrossCurve 提供 10% 懸賞</h2>
</div><p>In a public statement, CrossCurve CEO Boris Povar said the team had traced the movement of stolen assets to ten specific Ethereum addresses.</p>
<div class="lb-trans"><p>在一份公開聲明中，CrossCurve 首席執行官 Boris Povar 表示，團隊已追蹤到被盜資產的流動到十個特定的以太坊地址。</p>
</div><p>He noted that the tokens were taken due to a smart contract flaw and appealed to the recipients to return the funds, stating that there was “no indication of malicious intent.”</p>
<div class="lb-trans"><p>他指出，由於智能合約缺陷，代幣被盜，並呼籲接收者歸還資金，表示 “沒有惡意意圖的跡象”。</p>
</div><p>“If the funds are not returned or no contact is established within 72 hours, we will have to assume malicious intent and treat this as a judicial matter,” Povar said.</p>
<div class="lb-trans"><p>“如果資金在 72 小時內未歸還或未建立聯繫，我們將不得不假設存在惡意意圖，並將此視為司法事務，” Povar 説。</p>
</div><p>The project will offer a 10% bounty if funds are returned within the given deadline, Povar added.</p>
<div class="lb-trans"><p>Povar 補充説，如果在規定的截止日期內歸還資金，項目將提供 10% 的懸賞。</p>
</div><p>CrossCurve has previously marketed its multi-layered consensus bridge architecture as a safeguard against typical single points of failure in cross-chain systems.</p>
<div class="lb-trans"><p>CrossCurve 之前曾將其多層共識橋接架構宣傳為防範跨鏈系統中典型單點故障的保障。</p>
</div><p>Its validation stack includes integrations with networks such as Axelar and LayerZero alongside its proprietary EYWA Oracle Network.</p>
<div class="lb-trans"><p>其驗證堆棧包括與 Axelar 和 LayerZero 等網絡的集成，以及其專有的 EYWA Oracle Network。</p>
</div><p>In past documentation, the CrossCurve team has claimed that “the probability of several crosschain protocols getting hacked at the same time is near zero.”</p>
<div class="lb-trans"><p>在過去的文檔中，CrossCurve 團隊曾聲稱 “多個跨鏈協議同時被黑客攻擊的概率接近於零。”</p>
</div><p>The latest breach has also drawn comparisons to the 2022 Nomad Bridge exploit, which exposed similar vulnerabilities in validation logic.</p>
<div class="lb-trans"><p>此次最新的漏洞也引發了與 2022 年 Nomad Bridge 漏洞的比較，該漏洞暴露了驗證邏輯中的類似漏洞。</p>
</div><p>At the time, a coding oversight in smart contract upgrades allowed users to copy and paste transactions to drain nearly $190 million in a free-for-all heist involving over 300 unique addresses.</p>
<div class="lb-trans"><p>當時，智能合約升級中的編碼失誤使用户能夠複製和粘貼交易，導致近 1.9 億美元的資金在涉及超過 300 個獨特地址的搶劫中被盜。</p>
</div><p>The post CrossCurve identifies 10 wallets involved in the $3M bridge exploit appeared first on Invezz</p>
<div class="lb-trans"><p>文章《CrossCurve 識別出參與 300 萬美元橋接漏洞的 10 個錢包》首次出現在 Invezz 上。</p>
</div>

CrossCurve identifies 10 wallets involved in the $3M bridge exploit

- CrossCurve 識別出 10 個以太坊錢包地址，涉及 300 萬美元的橋接漏洞盜竊事件。  
- 攻擊者利用智能合約漏洞，繞過消息驗證發佈資金。  
- CrossCurve 已呼籲用户暫停與協議的互動，調查仍在進行中。

CrossCurve 識別出與 300 萬美元橋接漏洞相關的 10 個錢包