Bridge Security Economics: What Cross-Chain Trust Costs in 2026

On Sunday, September 6, roughly 4,000 BTC, worth about $320 million, walked out of the wallet that backs Blockstream’s Liquid Network, a Bitcoin sidechain that had guarded that reserve without incident for years. Whoever moved the coins left a note inside an on-chain transaction: “we are whitehats. contact us on chain.” A day later they offered to return “most” of the money, but only after Blockstream ships a patch and every node runs it.

Liquid is not a weekend fork with an unaudited contract. It is an eight-year-old federated peg run by a well-known company, with a high signing threshold and a dedicated key that has to approve every withdrawal. Blockstream says there is no evidence that the key itself was compromised, which is the most revealing detail of all: the money left through a system that, on paper, was working.

That is the pattern behind almost every large cross-chain theft of the past five years, and it is why “is the contract audited” is the wrong first question to ask about a bridge. Bridge security is an economics problem before it is an engineering one. A bridge is a vault that holds a growing pile of other people’s money, and its safety reduces to one comparison: how much sits in the vault, against how much it costs an attacker to make the parties guarding it approve a withdrawal that should never clear. When the prize is worth more than the cost to corrupt the guards, a bridge stops being a payment rail and becomes a standing bounty. If you want the step-by-step version for protecting your own wallet, our field guide to bridging safely covers that ground; here we are looking at the economics that decide which bridges deserve your money in the first place.

A Bridge Is a Vault, Not a Wire

When you bridge an asset, you are almost never sending the original coin anywhere. In the most common design, you deposit a token on chain A into a contract or a custodian, and a matching wrapped token is minted for you on chain B. The deposit stays locked. The wrapped token is an IOU that says the locked deposit exists and belongs to whoever holds the IOU. Redeeming reverses it: burn the IOU on chain B, unlock the original on chain A. Nothing crosses the gap except a message saying a deposit happened.

The consequence is that a busy bridge accumulates a reserve. Every unredeemed deposit adds to a pool of real assets sitting behind a set of rules about who is allowed to release them. Cross-chain flows still run well above $10 billion a month by 2026 tallies, so a large bridge is not so much moving that money as warehousing a slice of it at any given moment.

This is the honeypot. A single exchange hot wallet or a lending pool can hold plenty of value too, but a bridge is unusual because its reserve is guarded by a comparatively small and often obscure set of signers, oracles, or validators whose only job is to confirm that something happened on another chain. The value is large and public; the thing protecting it is small and easy to overlook. Attackers worked this out years ago, which is why bridges have absorbed more than $2.8 billion in cumulative losses since 2021, close to 40% of all the value ever stolen in crypto.

The Only Number That Matters: Prize Versus Cost to Corrupt

Strip away the jargon and every bridge design answers the same question in a different way: what does an attacker have to compromise to move the reserve, and what would that compromise cost? Call that the bridge’s security budget. It is not the size of the audit or the length of the bug-bounty page. It is the real-world price of making the honest verification system approve a lie: phishing enough signers, seizing enough infrastructure, buying enough validators, or finding the one logic gap that makes the whole set nod along.

Security holds when the cost to corrupt the trust set is comfortably higher than the prize inside the vault. It fails when the prize grows faster than the budget, which is exactly what happens to a successful bridge: deposits pile up while the signer set stays the same size. A 5-of-9 multisig that felt adequate guarding $20 million is wildly underpriced guarding $600 million, even though not a single line of code changed. The attacker’s incentive scales with the reserve; the defender’s cost to be compromised does not.

A rough worked example makes the mismatch concrete. Suppose a bridge is guarded by nine signers, and compromising each one, through phishing, malware, or a bribe, costs an attacker on the order of a few hundred thousand dollars of effort. If the design needs five of those nine, the attacker’s bill to forge a withdrawal is a couple of million dollars at most. Against a $20 million reserve that is a losing trade; against a $600 million reserve it is one of the best risk-adjusted returns in finance. Nothing about the cryptography changed between those two moments. Only the ratio did, and the ratio is the security.

This reframes a lot of confusing incidents. People ask why bridges keep breaking despite audits, formal verification, and years of hard lessons. The answer is that most audits check whether the code does what the designers intended, and in the biggest thefts the code did exactly that. The attack was not on the logic; it was on the small group of humans, keys, and servers that the logic trusts to tell it the truth. Sergej Kunz, co-founder of the exchange aggregator 1inch, put the incentive plainly after the year’s largest theft: “Security is often not the top priority. Teams focus on launching quickly.”

Why It Is the Keys, Not the Code

The data backs this up bluntly. TRM Labs, tracking crypto thefts across the first half of 2026, counted a record number of incidents but a lower total dollar figure than a year earlier: 207 hacks and about $972 million stolen, down sharply from roughly $2.3 billion in the first half of 2025. The important split is by category, not by count. Smart-contract exploits made up most of the incident count, but infrastructure, private-key, and operational compromises, roughly 15% of incidents, accounted for around 76% of the value. In plain terms: coding bugs are common and mostly cheap, while stolen keys and hijacked infrastructure are rarer and catastrophically expensive. Bridges live at the expensive end.

Ben Fisch, chief executive of Espresso Systems, put it precisely after that record theft. “Most bridges don’t fully verify what happened on another chain,” he told CoinDesk. “Instead, they rely on a smaller system to report it.” His verdict on the hack was the sentence that should be printed on every bridge’s front page: “The bridge worked as designed. It just believed the wrong information.”

If the attack surface is the trust set, then the attacker’s cheapest path is social engineering and supply-chain compromise, not clever Solidity. The Ronin theft, still the largest in crypto history at about $625 million, began with a fake job offer and a malware-laced document sent to a senior engineer. The people behind that operation, and behind a large share of 2026’s stolen value, were state-linked crews who treat a bridge’s developers as the real target; we covered how they get inside payrolls in our post-mortem on North Korea’s IT-worker infiltration. The same lesson runs through the supply-chain attacks that keep hitting crypto teams: the contract can be flawless while the developer’s laptop, build pipeline, or infrastructure is wide open.

The Prize: A Decade of Landmark Failures

The clearest way to see the prize-versus-budget mismatch is to line up the biggest bridge failures and note what actually broke in each. Very few were pure contract bugs.

Read down the fifth column and the audit obsession looks misplaced. Ronin and Harmony were signer compromises. Wormhole was a signature-verification gap that let an attacker forge approval from a nineteen-member guardian set, after which its backer Jump Crypto replaced the full 120,000 ETH within about a day. Multichain was not a hack at all in the usual sense; its operator was detained and the keys he alone controlled went dark. Nomad was a botched upgrade that set the trusted root to a value which made every message look valid, then turned into what investigators called decentralized robbery as hundreds of strangers copied the first attacker’s transaction. Even the cases that did turn on a coding error were really failures of what the code chose to trust.

The BNB Bridge case adds a twist worth sitting with. An attacker forged a proof and minted BNB out of thin air, a face value in the hundreds of millions, yet the chain’s small and centralized validator set was able to halt the entire network within hours and freeze most of the loot before it could leave. The same concentration that made the bridge attackable is what contained the damage. Security-budget math is not only about preventing the breach; it is also about what the system can still do in the minutes after one.

The Trust Set: Who You Have to Corrupt

Because the trust set is the real attack surface, it is worth grading bridges by how expensive that set is to compromise. The models below run roughly from cheapest to hardest to corrupt.

The jump from the top of that table to the bottom is the whole game. A federated multisig can be undone by phishing a handful of people, and if those people all work at one company, as they effectively did at Ronin, a 5-of-9 is really 1-of-1 dressed up. An attestation network raises the bar in proportion to how many independent operators must be corrupted, which is why the difference between one verifier and twenty is not incremental but existential. KelpDAO’s rsETH bridge was configured, at the moment it mattered, to accept a single verifier’s word; attackers compromised the internal infrastructure feeding that verifier, a supply-chain style compromise, and spoofed a cross-chain message for about $292 million. A light-client or zero-knowledge bridge sits at the bottom because breaking it means breaking the cryptography or a chain’s consensus itself, not bribing a committee.

This is also where the theoretical ceiling lives. Vitalik Buterin argued back in 2022 that there are fundamental limits to the security of bridges that hop across multiple zones of sovereignty, his case for a future that is multi-chain but not truly cross-chain. The designs at the bottom of the table are the industry’s attempt to push against that ceiling with math rather than trust.

Shrinking the Prize: Native Issuance and Intents

If security is prize versus budget, there are two ways to win: make the budget enormous, or make the prize small. The most important shift of the past two years has been the second one.

Native issuance removes the honeypot instead of guarding it. Circle’s Cross-Chain Transfer Protocol does not lock USDC in a pool and mint a wrapped copy; it burns the USDC on the source chain and mints genuine, native USDC on the destination, with no pooled reserve sitting around to steal. There is still a trust assumption, since you are trusting Circle’s attestation, but there is no growing vault of locked collateral that becomes more tempting every week. The same logic is driving wrapped Bitcoin toward mint-and-burn issuance and pushing major tokens onto standards that let issuers control their own cross-chain supply.

Intents and solver networks attack the prize from another angle. In an intent-based bridge such as Across, you state what you want (say, 10 ETH on Arbitrum) and a competitive network of solvers fronts you the funds on the destination immediately from their own capital, then gets reimbursed later through the underlying settlement layer. The user is made whole in seconds, and the money at risk in any single fill is a solver’s own float, not a communal reserve holding everyone’s deposits. The honeypot is broken into many small, privately owned pieces, each a far less interesting target. Fees have compressed as solvers compete, a useful reminder that safer and cheaper are not always opposites.

None of this is a free lunch. Native issuance moves trust to the issuer, so a compromise or a freeze at Circle or at a wrapped-BTC custodian becomes the new single point of failure, and intent networks depend on solvers holding capital and on honest settlement to reclaim it. The honeypot shrinks, but it does not vanish; it changes shape, from a communal vault into issuer risk and solver risk. The point is not that these designs are unbreakable. It is that they hold far less at rest, so the prize an attacker can win in a single move is smaller, which is exactly the lever the security-budget math rewards.

Raising the Cost: More Verifiers, or Just Math

Where a bridge genuinely must hold a reserve, the other lever is to make the trust set painfully expensive to corrupt. Two approaches dominate in 2026.

The first is stacked, independent verification, sometimes called defense in depth. LayerZero’s V2 lets an application require an X of Y of N set of decentralized verifier networks to agree before a message is accepted, so a treasury can demand, say, five of twenty configured DVNs rather than the single verifier that sank KelpDAO. Chainlink’s CCIP runs a separate Risk Management Network alongside its main committee, built so that a bug in one code path is caught by an independently written second one, with the system biased toward halting rather than approving when the two disagree. The stated design philosophy is defense in depth rather than trust in any single component, and the point of all of it is to multiply the number of independent things an attacker has to defeat at once.

The second approach removes the committee. A light client verifies another chain’s consensus directly inside a smart contract, and a zero-knowledge bridge compresses that verification into a succinct proof that anyone can check cheaply. Cosmos IBC has secured inter-chain transfers this way for years, and projects such as Polyhedra’s zkBridge relay block headers and prove state with validity proofs rather than a signing quorum. When it works, the cost to corrupt is no longer bribe the validators; it is break the proof system, a very different and much larger number. The same trust-minimizing instinct is reshaping Bitcoin’s own scaling, where designs like statechains try to move coins quickly while shrinking who you have to trust. The trade-offs are cost, proving time, and complexity, but the direction is clear: replace people you must trust with math you can check.

The Bitcoin Problem: Wrapped BTC, Federations, and the $320M Reminder

Bitcoin makes all of this harder. Its scripting language cannot verify another chain’s state the way a smart-contract platform can, so moving BTC into DeFi has always meant handing custody to someone: a company that mints wrapped BTC against coins it holds, or a federation that collectively controls a peg. Both are, in security-budget terms, high-prize designs guarded by a defined and therefore attackable set of keys. With Bitcoin trading near $80,000, the reserves behind these pegs are measured in the billions.

That is the backdrop to the Liquid incident. Liquid is a federated sidechain: a group of functionaries collectively controls the Bitcoin that backs L-BTC, and withdrawals are meant to clear only through an authorized path, in this case a peg-out authorization key operated through the SideSwap settlement layer. The federation threshold is high and the design is mature, yet roughly 95% of the reserve still left in a single sweep. Blockstream’s early statement that the authorization key was not itself compromised points, once again, at the logic around the key rather than the key’s secrecy, the same class of failure Fisch described: a system approving a withdrawal it should have refused.

Wrapped Bitcoin is the same story at a larger scale. Custodians hold the real BTC and issue a token against it, so the security question is not about Bitcoin at all but about the custodian’s keys, governance, and the bridge that carries the wrapper between chains. That is why the year’s scramble to move billions of dollars of wrapped BTC onto more heavily verified routes, discussed below, was really a scramble to raise the security budget behind an asset whose reserve had quietly grown into one of the largest honeypots in the market.

The lesson is not that federations are uniquely bad. It is that concentration of custody is the risk, whatever the wrapper. That is why the more interesting Bitcoin work in 2026 aims to shrink that trust: programmable spending conditions that spread control across keys and timelocks, which we covered in our look at Taproot’s script path and modern Bitcoin custody, and off-chain constructions that reduce how much you have to trust an operator at all. None of it eliminates trust for wrapped BTC entirely, but it moves the security budget in the right direction.

The Market Is Repricing Bridge Security

The clearest sign that bridge security is an economics problem is that the market now prices it directly. After the KelpDAO hack exposed a single-verifier configuration, capital did not wait for a committee report. Within weeks, billions in bridged assets moved to designs with larger security budgets.

The migration from LayerZero toward Chainlink’s CCIP is the headline example. By early August 2026, after custodian BitGo moved more than $7 billion of wrapped Bitcoin to CCIP as its sole cross-chain provider, one running tally put the assets that had switched at close to $15 billion. The pattern was a steady flight by treasuries and issuers, Kraken’s kBTC, Lombard, Solv, Mantle and others, toward a design that secures each route with many independent node operators rather than a configurable single verifier. Johann Eid of Chainlink described the shift as a continued flight to safety.

You do not have to believe CCIP is flawless to read the signal. Sophisticated holders are behaving exactly as the prize-versus-budget model predicts: when the value at stake is large, they pay up for a bigger security budget, and they abandon designs whose budget looks small relative to what they hold. That is the market doing risk pricing no audit badge captures, and it is a healthier discipline than waiting for the next post-mortem.

The Third Lever: What Happens After It Breaks

There is a third input to a bridge’s real security that users routinely ignore until it is too late: the recovery backstop. Two bridges can share an identical trust model and offer wildly different outcomes after a theft, depending entirely on who, if anyone, is willing to make users whole.

The spread is stark. When Wormhole lost about $325 million, its backer replaced the full stake within roughly a day and users never felt it. When KelpDAO lost $292 million, a coalition of DeFi protocols rebuilt the backing over about five weeks so that no losses passed to users. When Poly Network was drained of more than $610 million, the attacker was talked into returning almost everything in exchange for a bounty and the nickname Mr. White Hat. And when Harmony’s Horizon bridge lost around $100 million to a 2-of-5 multisig compromise, there was no deep pocket and no coalition; recovery was minimal. Same category of failure, opposite endings. A bridge’s backstop is part of its security whether it is advertised or not.

When “White Hat” Is Just Leverage

The Liquid saga is a live case study in the messiest part of recovery: the negotiation. Days after the coins moved, the party holding them offered to return “most” of the reserve, with no figure attached, no deadline, and a condition that Blockstream patch the flaw and every node adopt the fix first. They branded themselves white hats. Not everyone is buying it.

Charles Guillemet, chief technology officer at hardware-wallet maker Ledger, was blunt about the label. “White hats don’t drain a bridge and then solicit an on-chain contact,” he argued, noting that genuine security researchers disclose a flaw before moving hundreds of millions in collateral, not after, and comparing the choreography to earlier incidents where an attacker drained a system and only then proposed to talk. He later allowed that the actors might yet prove well-intentioned, since even criminal crews sometimes open a channel, but the sequence, move the money first, announce good intentions second, looks more like leverage than a disclosure.

That is the uncomfortable economics of recovery. Once the funds are gone, a return is a negotiation, and we will give most of it back after you fix the bug is a bargaining position, not a refund. The Poly Network ending, near-total return, is the outlier people remember; the Harmony and Multichain endings, where funds vanished into mixers or a shut-down operator, are more typical. Treating the promise of a white-hat return as a safety net is a good way to be disappointed.

What the SEC Can and Cannot Do

If a bridge holding your assets is drained, the instinct is to ask who is liable and who can claw the money back. In the United States the honest answer is: less than you would hope, and slowly. The Securities and Exchange Commission and the Commodity Futures Trading Commission spent 2026 clarifying that most crypto assets are not securities, a joint interpretation that sorted tokens into categories rather than expanding the SEC’s reach over them. That is jurisdiction, not restitution.

Sanctions have proved a blunt tool. After the Ronin and Harmony thefts, the Treasury sanctioned the mixer that laundered the proceeds, but a federal appeals court later found the government had overstepped, since immutable smart contracts cannot be the property of any sanctionable person once no one controls them, and Treasury removed Tornado Cash from its sanctions list in March 2025. The same property that makes a trust-minimized bridge hard to attack after deployment, no operator with a kill switch, also makes it hard to sanction or unwind after a theft.

Criminal prosecution of individuals has held up better than sanctions against code. Cases against named developers and launderers have produced convictions and extraditions, and a bridge exploiter who touches a regulated exchange to cash out leaves exactly the trail law enforcement follows. But none of that is fast, and little of it makes a drained user whole. Recourse, like everything else about bridges, is an economics question: the cheaper it is to move and launder the prize, the less any regulator can do once it is gone.

How to Read a Bridge’s Security Budget

You cannot audit a bridge yourself, but you can read its security budget the way an analyst would, in a few minutes, before you trust it with size. The questions that matter are not about branding.

• Who has to be corrupted? Count the trust set and, more importantly, its independence. A 9-of-12 run by one company is not nine independent failures; it is one.
• How big is the prize? A reserve worth billions behind a small signer set is underpriced no matter how clean the code looks.
• Native or wrapped? Native mint-and-burn removes the pooled honeypot; a wrapped IOU backed by a locked reserve keeps it.
• Configuration, not just capability? A protocol that can require many verifiers but ships with one gives you the security of one.
• Is there a backstop? A named backer or a track record of making users whole matters more than a bug-bounty page after the fact.
• Do you even need the bridge? An exchange transfer, a native-issuance route, or an aggregator that holds no reserve is sometimes the safer path.

Run those questions and the confusing bridge got hacked again headlines resolve into a single pattern. The bridges that break are the ones whose prize outran their budget; the bridges that survive are the ones that either shrank the prize, raised the budget, or arranged a backstop before they needed one. Bridge security in 2026 is not a mystery of clever exploits. It is arithmetic, and the arithmetic is finally getting easier to read.

Frequently Asked Questions

Why do crypto bridges get hacked so often?

Because a busy bridge holds a large reserve guarded by a small, defined set of signers, validators, or servers. When the value in the vault grows faster than the cost of compromising that trust set, the bridge becomes a standing bounty. Most large bridge thefts were compromised keys, infrastructure, or verification logic rather than clever contract bugs; TRM Labs data shows infrastructure and operational compromises drove about 76% of stolen value in the first half of 2026.

What is the safest way to move assets across chains in 2026?

The safest routes hold as little value at rest as possible. Native mint-and-burn transfers such as Circle’s CCTP for USDC and intent-based solver networks such as Across avoid a large pooled honeypot, and a regulated exchange transfer sidesteps bridge risk entirely for supported assets. Where you must use a lock-and-mint bridge, prefer one secured by many independent verifiers or by cryptographic proofs.

Is wrapped Bitcoin safe?

Wrapped BTC concentrates custody with a company or a federation, a high-prize design guarded by a defined set of keys. The September 2026 Liquid Network incident, where about $320 million left a mature federated peg, shows that even a reputable, high-threshold custodian can lose most of a reserve through a flaw in the withdrawal logic. Wrapped BTC can be useful, but treat the custodian’s trust model, not the Bitcoin in the name, as the real risk.

Can the SEC or law enforcement recover stolen bridge funds?

Rarely and slowly. US regulators have clarified how crypto assets are classified, but that is not a restitution mechanism, and sanctions against laundering tools have been partly reversed in court. Criminal cases against individual developers and launderers have had more success than sanctions against protocols, but little of it makes a drained user whole quickly.

What does it mean that bridge hacks are about the keys, not the code?

It means the biggest losses come from compromising what a bridge trusts, its keys, infrastructure, and verification inputs, rather than from bugs in the smart contract. TRM Labs found that infrastructure and operational compromises were about 15% of 2026 incidents but roughly 76% of the value stolen. Evaluating a bridge therefore means asking who has to be corrupted to move the money, not just whether the contract was audited.

Yuki Tanaka is a DeFi and on-chain security correspondent at HOGE Wire.