Crosswise's MasterChef contract had public exposure of privileged functions, allowing an attacker to gain unauthorized access. The hacker exploited this to set a trusted forwarder, compromise owner privileges, and withdraw 692K CRSS tokens. After swapping to WBNB, the attacker laundered 547 WBNB through Tornado Cash.

Decentralized trading platform Crosswise was attacked in nearly an hour, losing about $879,000. The hacker exploited a publicly exposed privileged function, which was then used to set trustedForwarder and further hijack Crosswise's owner privileges. The stolen funds have now been transferred to Tornado Cash for mixing.