Connect with us
DAPA Banner

Crypto World

CrossCurve Bridge Exploited for $3 Million Through Smart Contract Validation Flaw

Published

on

21Shares Introduces JitoSOL ETP to Offer Staking Rewards via Solana

TLDR:

  • CrossCurve’s ReceiverAxelar contract lacked validation checks, enabling attackers to spoof messages. 
  • The exploit drained approximately $3 million from PortalV2 across multiple blockchain networks. 
  • Security experts compare the incident to Nomad’s 2022 bridge hack that lost $190 million in funds. 
  • Curve Finance advised users to review positions in EYWA-related pools following the security breach.

 

CrossCurve, a cross-chain liquidity protocol formerly known as EYWA, confirmed a security breach on Sunday that drained approximately $3 million from its bridge infrastructure.

The attack exploited a validation vulnerability in the protocol’s smart contracts, prompting the team to urge users to halt all platform interactions.

The incident affects multiple blockchain networks and raises concerns about bridge security practices in decentralized finance.

Missing Validation Check Enables Unauthorized Token Withdrawals

The exploit targeted a critical weakness in CrossCurve’s ReceiverAxelar contract, according to blockchain security account Defimon Alerts.

Advertisement

Attackers bypassed gateway validation by calling the expressExecute function with fabricated cross-chain messages.

This manipulation triggered unauthorized token unlocks from the protocol’s PortalV2 contract without proper verification.

Data from Arkham Intelligence revealed the PortalV2 contract’s balance collapsed from roughly $3 million to nearly zero on January 31.

The attack spread across multiple networks connected to CrossCurve’s bridge infrastructure. Security expert Taylor Monahan drew comparisons to Nomad’s $190 million bridge hack in 2022, which saw over 300 wallets drain funds simultaneously.

Advertisement

“I cannot believe nothing has changed in four years,” Monahan stated when analyzing the exploit’s similarities to previous bridge vulnerabilities.

The ReceiverAxelar contract lacked essential validation checks that should have prevented spoofed messages from executing token transfers. This fundamental oversight allowed attackers to manipulate the system and extract funds systematically.

CrossCurve issued an urgent notice on X acknowledging the ongoing attack. “Our bridge is currently under attack, involving the exploitation of a vulnerability in one of the smart contracts used,” the team announced.

The protocol requested users pause all CrossCurve interactions while investigators assessed the damage and identified remediation steps.

Protocol’s Security Claims Contradicted by Exploit Mechanics

CrossCurve operates a cross-chain DEX and consensus bridge developed alongside Curve Finance. The platform employs a Consensus Bridge mechanism routing transactions through multiple validation protocols including Axelar, LayerZero, and the EYWA Oracle Network. This architecture aimed to eliminate single points of failure in cross-chain operations.

The project previously marketed its security framework as superior to competitors. Protocol documentation claimed “the probability of several crosschain protocols getting hacked at the same time is near zero.”

However, the exploit bypassed these protections by targeting the validation layer rather than the consensus mechanism itself.

Advertisement

Curve Finance founder Michael Egorov invested in the protocol during September 2023. CrossCurve later disclosed raising $7 million from venture capital firms to expand operations.

The protocol rebranded from EYWA Protocol while maintaining its core bridge technology and partnership relationships.

Curve Finance responded to the incident by advising users with allocations in EYWA-related pools. “Users who have allocated votes to Eywa-related pools may wish to review their positions and consider removing those votes,” the platform stated on X.

The organization encouraged participants to exercise caution when engaging with third-party protocols and make risk-aware decisions.

Advertisement

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

EngageLab Flaw Opened 30M Wallet Apps to Android Data Theft: Microsoft

Published

on

Brian Armstrong's Bold Prediction: AI Agents Will Soon Dominate Global Financial

TLDR:

  • Microsoft found the EngageLab SDK bug could expose private wallet data across 30M Android installs globally.
  • The flaw abused Android intents to grant hostile apps persistent read and write provider permissions.
  • EngageLab fixed the issue in v5.2.1 by changing MTCommonActivity to non-exported status.
  • Google Play removed affected wallet apps, while Android added safeguards for already installed versions.

Microsoft has disclosed a severe Android SDK vulnerability that placed more than 30 million crypto wallet installs at risk. The flaw affected EngageLab’s widely used EngageSDK, which many wallet apps used for push messaging features. 

According to Microsoft’s security research, the issue enabled malicious apps on the same device to bypass sandbox protections. Google Play has since removed all identified apps using the vulnerable SDK versions.

EngageLab Android SDK Flaw Exposed Crypto Wallet Attack Surface

Microsoft said the issue centered on an exported Android activity called MTCommonActivity

The component was automatically added during manifest merging after developers imported the SDK. Because it appeared post-build, many teams likely missed it during review. That left production APKs open to hidden risk.

The vulnerable flow began when the activity received an external intent. Its onCreate() and onNewIntent() callbacks both routed data into processIntent()

Advertisement

That method extracted a URI string and forwarded it deeper into the SDK logic. The chain eventually rebuilt and launched a new intent.

Microsoft’s write-up noted the critical failure happened in a helper method. Instead of returning a safe implicit intent, it returned an explicitly targeted one. That changed Android’s normal resolution path and let hostile apps redirect execution. 

In practice, the vulnerable wallet app launched the malicious payload with its own privileges.

The risk worsened because the SDK used Android’s URI_ALLOW_UNSAFE flag. That allowed persistent read and write URI permissions inside the redirected intent. 

Advertisement

A malicious app could then gain access to non-exported content providers. From there, sensitive wallet files, credentials, and user data became reachable.

Microsoft Patch Timeline and Android Wallet Mitigation Guidance

Microsoft Security Vulnerability Research first identified the flaw in EngageSDK version 4.5.4 in April 2025. It then notified EngageLab under coordinated disclosure rules. 

The Android Security Team also received the report because affected apps were live on Google Play. The fix arrived months later in version 5.2.1 on November 3, 2025.

In the patched release, EngageLab changed the vulnerable activity to non-exported. That single change blocks outside apps from invoking the component directly. Microsoft said it currently has no evidence of in-the-wild exploitation. Still, it urged developers to update immediately.

Advertisement

The report stressed that third-party SDKs can silently expand wallet attack surfaces. 

Crypto apps face elevated stakes because they often store keys, credentials, and financial identifiers. Even minor upstream library flaws can ripple across millions of devices. This case pushed total exposure above 50 million installs when non-wallet apps were included.

Microsoft also said Android added automatic protections for previously installed vulnerable apps. Those mitigations reduce risk while developers migrate to the fixed SDK. 

The company urged teams to inspect merged manifests after every dependency update. That review can catch exported components before release.

Advertisement

Source link

Continue Reading

Crypto World

XRP Price Flashes Multiple Bottom Signals As Bulls Defend $1.30.

Published

on

XRP Price Flashes Multiple Bottom Signals As Bulls Defend $1.30.

XRP (XRP) has been in an eight-month downtrend, with momentum and onchain indicators at levels that previously coincided with macro bottoms.

Data from TradingView reveals that the relative strength index (RSI) of the XRP/BTC ratio is at 24, the most oversold level since October 2025. 

Such low levels in the daily RSI have marked market bottoms for the ratio, ultimately leading to 65% to 345% XRP price breakouts against Bitcoin as seen late 2024 and 2025.

XRP/BTC daily chart. Source: Cointelegraph/TradingView

The chart above also shows that the XRP/BTC pair is trading within a long consolidation range, which has previously acted as a strong launching pad for the ratio.

The last time XRP bottomed against Bitcoin around this zone was in June 2025. It marked the beginning of a 61% increase in the XRP/BTC ratio, accompanying a 92% XRP price rally to a multi-year high of $3.66.

Advertisement

Other instances shown by the yellow bars in the chart reinforce the reliability of this level in marking macro bottoms for XRP/BTC. 

MVRV Z-Score suggests XRP price is bottoming

XRP’s MVRV Z-score is hovering near zero, a level that historically aligns with accumulation zones and market bottoms.

This indicates that most holders are close to breakeven, reducing sell pressure and signalling potential downside exhaustion. Similar patterns appeared in 2021, 2022 and 2024 before major rallies.

XRP MVRV Z-score vs. price. Source: Glassnode

Note that the last time XRP’s MVRV Z-score fell to similar levels in late 2024 coincided with a macro market bottom at $0.30 and preceded a multi-month rally, with the XRP/USD pair rising 500% to a multi-year high above $3. 

Meanwhile, the 0.80 MVRV pricing band, which has historically marked cycle bottoms, is currently at $1.14, coinciding with a 15-month low reached on Feb. 6.

Advertisement
XRP: MVRV pricing bands. Source: Glassnode

These onchain metrics suggest that XRP is undervalued and may continue the ongoing recovery, potentially rising toward $1.70 or higher

XRP price must hold above $1.30 

Meanwhile, XRP/USD remains cautiously bullish as long as it holds the $1.25-$1.30 support zone. 

“$XRP is sustaining the major support zone between $1.30-$1.25 levels since early Feb’26,” trader ChiefraT said in an X post on Friday, adding:

“If this zone continues to hold, then a short-term bounce towards $1.45 can’t be ruled out.”

XRP/USD daily chart. Source: Cointelegraph/TradingView

The importance of this support level is reinforced by cost basis distribution. The heatmap below shows that nearly 1.73 billion XRP were acquired around this price.

XRP cost-basis distribution heatmap. Source: Glassnode

Below that, the next line of defence is the $1.15 demand zone, where the 200-week simple moving average is. 

If XRP/USD drops below this level, it would be in a free-fall toward the measured target of the bear flag at $0.80, or 41% below the current price.

As Cointelegraph reported, holding $1.27-$1.30 would be a sign of strength among the bulls who must push the XRP/USD pair toward the $1.61 range high to regain control. 

Advertisement