Flaw allowed spoofed messages to unlock CrossCurve tokens

[chainsniff]

Security analysts say the CrossCurve exploit stemmed from a critical validation failure in one of its smart contracts. According to Defimon Alerts, attackers were able to spoof cross-chain messages that bypassed gateway checks and triggered token unlocks.

The flaw reportedly allowed anyone to call a function known as expressExecute on the ReceiverAxelar contract, enabling unauthorized withdrawals through the PortalV2 system. As news of the exploit spread, Curve Finance — a partner of CrossCurve — warned users who allocated votes to CrossCurve pools to review their positions and consider removing exposure, emphasizing the risks of interacting with third-party protocols.