Cross-chain bridge failures at CrossCurve and KelpDAO expose verifier trust risks

CrossCurve disclosed a roughly $3 million cross-chain bridge exploit after attackers abused a validation weakness, prompting the protocol to pursue legal action while investigators worked to trace the stolen funds. Reporting on the incident said the attack targeted the bridge’s transaction verification logic rather than a simple wallet compromise, underscoring how weaknesses in cross-chain message validation can let adversaries authorize fraudulent transfers and drain locked assets.

A larger breach hit KelpDAO, where attackers stole about $290 million in rsETH by exploiting its LayerZero-based bridge path with effectively 1-of-1 DVN verification, allowing a forged packet to be accepted on Ethereum without a legitimate source-chain transaction. The theft was widely attributed to North Korea-linked Lazarus/TraderTraitor, and recovery efforts later included burning more than 117,000 rsETH held by the exploiter on Arbitrum, restoring backing through an Aave-controlled recovery wallet, increasing bridge requirements to four independent attestors and 64 block confirmations, and beginning a migration to Chainlink CCIP after investigators characterized the incident as an operational and verification failure rather than a confirmed public smart-contract bug.