Bridge Security in 2026: When the Safest Bridge Is No Bridge

On September 6, 2026, roughly 4,000 BTC left the federation wallet behind Blockstream’s Liquid Network. With Bitcoin trading near 79,000 dollars, that was about 320 million dollars, and it walked out through a completely ordinary peg-out that eleven of the federation’s fifteen signing keys approved. Nothing looked wrong to the people holding those keys. According to a forensic reconstruction by Bitquery, a range-proof verification bug in Elements, the software Liquid runs on, let the attackers mint L-BTC that was never backed by real Bitcoin and then redeem it. The honest signers were not fooled into signing a malicious transaction; they signed a legitimate-looking withdrawal of coins the software insisted were real.

What happened next is why this incident belongs in a security explainer rather than an obituary. The attackers described themselves as white hats, and after Blockstream shipped a patch they returned about 3,400 BTC, holding back close to 600 BTC (near 47 million dollars) that they framed as a self-awarded bounty. Liquid resumed block production on September 10. Blockstream chief executive Adam Back urged holders not to “panic sell OTC” and said “the L-BTC peg with BTC will be covered.” The attackers, for their part, needled Blockstream for allocating only a small budget to protect billions in assets.

Sit with the shape of it. A federation run by a respected company since 2018, guarded by a high eleven-of-fifteen signing bar, lost nearly all of its reserves in an afternoon because the code that decides what is real got one thing wrong. That is the recurring anatomy of a bridge failure, and it is the reason 2026’s most interesting cross-chain story is not a better bridge at all. It is a growing argument that the safest bridge is no bridge.

What a bridge actually does with your money

Blockchains cannot read each other. Ethereum has no native way to know what happened on Solana, and Solana cannot verify a Bitcoin block on its own. A bridge exists to paper over that gap, and the most common way it does so is lock-and-mint. You deposit an asset on the source chain, the bridge locks it in a contract, and it mints a matching IOU token on the destination chain. Send USDC to a chain that does not issue native USDC and you receive a wrapped version, redeemable one-for-one, in theory, for the real thing sitting in the lockbox.

Two consequences fall out of that design, and both are security problems. First, the locked collateral piles up in one place. A busy bridge can hold hundreds of millions or billions of dollars, all guarded by the same keys and the same code, which is the textbook definition of a honeypot. Second, the wrapped token is only ever as trustworthy as whatever process mints it. If an attacker can convince the destination contract to mint tokens that are not backed, or unlock the collateral without a valid deposit, the peg is broken and the wrapped asset becomes a claim on an empty vault.

Ethereum co-founder Vitalik Buterin flagged this years ago, arguing there are “fundamental limits to the security of bridges that hop across multiple zones of sovereignty.” His thesis in a widely cited 2022 post was that a multi-chain world is fine, but a cross-chain world, where assets constantly move between sovereign systems that cannot verify one another, multiplies the ways things can go wrong. Four years and several billion dollars of losses later, that framing has aged well.

It is the keys, not the code

The popular image of a bridge hack is a clever hacker finding a bug in a smart contract. The data says otherwise. In its report on the first half of 2026, TRM Labs counted a record 207 hacking incidents but under 1 billion dollars stolen, roughly 972 million, down sharply from the year before. The revealing split is in where the value went: infrastructure, key, and operational compromises accounted for only about 15 percent of incidents but around 76 percent of the money. Smart contract bugs are common; the truly expensive breaks come from stolen keys, forged messages, and compromised verification systems.

The bridge-specific numbers tell the same story at scale. By several 2026 tallies, cross-chain bridges have lost more than 2.8 billion dollars cumulatively since 2021, and PeckShield’s running count put this year’s bridge-specific losses at around 328 million dollars across roughly eight incidents, most of it from a single exploit we will come to shortly. For historical context, Chainalysis found that bridge hacks alone accounted for about 2 billion dollars, close to 69 percent of all crypto stolen in 2022. Few categories of software concentrate this much value behind this little verification.

Bridges sit right at the center of that pattern. Ben Fisch, chief executive of Espresso Systems, put it cleanly after the year’s biggest bridge exploit: “Most bridges don’t fully verify what happened on another chain. Instead, they rely on a smaller system to report it.” The failure, he told CoinDesk, is usually not that the smart contract had a bug. “The bridge worked as designed. It just believed the wrong information.” In the same piece, 1inch co-founder Sergej Kunz was blunt about why: “Security is often not the top priority. Teams focus on launching quickly.”

Once you internalize the keys-not-code point, the whole topic reorganizes itself. The question stops being “is the contract audited” and becomes “who or what decides that a deposit really happened on the other chain, and how hard is it to lie to them.” That is the trust model, and it is the single most important thing to understand about any bridge.

Five ways to trust a bridge

Bridges differ mostly in what they use to verify cross-chain events, and that choice determines what an attacker has to compromise. The families below are a rough spectrum, from bridges that ask you to trust a small group of people to bridges that ask you to trust math.

Notice that the top of the table concentrates trust in a small human-controlled system, while the bottom pushes it toward code, proofs, and market competition. The historical hacks cluster heavily in the top two rows, which is exactly what the keys-not-code data predicts.

The middle of the spectrum is where most of the clever engineering now lives. External attestation networks replace a fixed multisig with a larger, often permissionless set of validators or oracles that watch the source chain and vote on what happened. Wormhole’s guardians and LayerZero’s decentralized verifier networks work this way, and the better designs let an application insist that several independent verifiers agree before a message is accepted, so corrupting one is not enough. The KelpDAO loss was a painful reminder of the flip side: when that requirement is quietly set to a single verifier, the whole scheme collapses back to one point of failure.

The landmark breaks, and what actually failed

The clearest way to see the pattern is to line up the big ones and ask, in each case, what actually failed. Almost none of them were a subtle Solidity bug that a better audit would have caught. They were keys, thresholds, forged messages, and operators.

The Ronin theft, still the largest in crypto history at around 625 million dollars, happened because Sky Mavis effectively controlled five of the nine validator keys and Lazarus Group social-engineered its way in through a fake job offer. Nomad lost roughly 190 million dollars when an upgrade set the trusted root to a blank value, turning the exploit into what Mandiant called decentralized robbery as hundreds of copycats replayed the same transaction. Multichain did not get hacked in the usual sense at all; it collapsed when its chief executive was detained and the keys he alone held went dark. Different stories, same lesson: the vault is only as safe as whoever, or whatever, holds the keys.

The 2026 idea that changes the question

If the core problem is a big pot of locked collateral guarded by a system that can be lied to, one answer is to stop building the pot. That is the premise behind intents, the design that reframed cross-chain movement in 2026. Instead of telling the system how to move your money (lock it here, mint an IOU there), you sign a statement of the outcome you want: I have 1,000 USDC on Arbitrum, I want at least 999 USDC on Base, fill it however you like. A competitive network of professional operators called solvers then races to satisfy that request from their own inventory, and gets reimbursed only after the system confirms you actually deposited what you promised.

The security shift is subtle but real. There is no standing vault of everyone’s collateral for an attacker to drain. The capital at risk in any single transfer is a solver’s own working funds for that fill, not the pooled deposits of thousands of users. If a solver is compromised or goes insolvent, the blast radius is that solver, not the whole protocol. From the user’s side, the experience is closer to signing a message than approving a bridge transaction, which also changes the risk surface at the wallet, a theme our guide to wallet UX in 2026 takes up in detail.

What turned intents from a clever trick into infrastructure was a shared standard. ERC-7683, co-authored by Uniswap Labs and Across and finalized in 2024, defines a common shape for a cross-chain order and a minimal interface that settlement contracts expose. In plain terms, it standardizes the message you sign and the interface a solver integrates against, so the same solver can fill orders across many protocols without a bespoke integration for each one. By 2026 that order format was being settled by Across, Eco, LI.FI, UniswapX, and Symbiosis, among others, which is what deep, competitive liquidity looks like when everyone speaks the same language.

How an intent actually settles

Walk through a single transfer to see where the trust actually sits. You sign an order, one of the two ERC-7683 types (a gasless order relayed on your behalf, or one you submit on-chain yourself), that locks your input funds in a settlement contract and declares your desired output on the destination chain. That order enters a competitive marketplace. Solvers, who keep inventory on many chains, bid to fill it, and the winner sends you the output on the destination chain almost immediately, out of its own pocket.

The solver is now exposed. It has paid you on the destination but has not yet been reimbursed on the source. It gets made whole only once the settlement system verifies that your input funds were genuinely locked, at which point the escrow releases to the solver. Across describes this model as separating the fast part (a solver fronting liquidity for a near-instant fill) from the slow part (the underlying verification that repays the solver), and it argues the result is materially faster and cheaper than a lock-and-mint route because users are not waiting on a bridge’s own multi-step message passing. Daily volume across intent-based systems routinely runs into the tens of millions of dollars, which is the market’s way of saying the model works.

Crucially, the honest solver takes on the timing risk, not the user. If verification fails, the solver eats the loss, not you, and not a pooled vault. That inversion, moving the risk to a well-capitalized professional who chose to take it, is the quiet reason intents feel safer than a classic bridge even when the underlying chains are exactly as untrusting of each other as before.

Competition does the rest of the work. Because solvers bid in an open auction to fill each order, users tend to capture the savings as tighter pricing and quicker fills, and a solver that misprices risk simply loses the bid. That same rivalry is what keeps any single solver from becoming a chokepoint, at least while the pool of active solvers stays healthy and diverse. It is a very different posture from a monolithic bridge, where there is only one path and one set of guards standing between you and your funds.

Native issuance: deleting the wrapped IOU

The other way to shrink the honeypot is to stop wrapping assets at all. For stablecoins and a growing list of major tokens, the issuer itself now runs the cross-chain rail, burning the token on the source chain and minting a fresh, fully native unit on the destination. There is no wrapped representation, no shared liquidity pool, and no third-party custodian holding a lockbox.

Circle’s Cross-Chain Transfer Protocol is the reference example. CCTP burns USDC on the origin chain, has Circle’s attestation service sign the burn, and mints native USDC on the destination across more than a dozen chains, with a faster settlement mode that clears in seconds by using Circle’s own short-term liquidity. Because the destination USDC is real USDC and not an IOU, there is simply no pot of locked collateral to steal and no peg to break. The same logic is spreading to Bitcoin wrappers and to token standards, such as cross-chain token frameworks that let an issuer keep control of its own supply as it moves between chains rather than surrendering it to a bridge.

Native issuance does not eliminate trust, it relocates it to the issuer, and it only works for assets whose issuer chooses to run a canonical rail. But for the assets that carry the most cross-chain volume, stablecoins above all, it removes the exact structure that produced the biggest historical losses. The comparison below sketches how the three approaches stack up.

What intents and native rails still do not fix

None of this makes cross-chain movement magically safe, and it is worth being honest about the limits. Intents still ride on an underlying messaging or settlement layer that has to verify the source-chain deposit before a solver is paid. The verifier problem does not vanish; it shrinks and moves behind the scenes. If that settlement layer uses a weak verification set, the intent experience can feel smooth while resting on the same fragile foundation as a classic bridge.

Solvers introduce their own questions. A network dominated by a few large solvers can drift toward centralization, censor certain orders, or extract value through transaction ordering, the cross-chain cousin of the MEV problems that already shape how automated market makers behave when the curve becomes the oracle. And liquidity-network designs are not immune to old-fashioned exploits: the Allbridge Core incident in 2026 was a flash-loan manipulation of a pool ratio, its second such hit after a nearly identical event years earlier, a reminder that documented lessons do not apply themselves.

Native issuance, meanwhile, only covers assets whose issuer opts in. The long tail of tokens still needs a classic bridge, which means the honeypot design is not going away, it is just being pushed to the edges of the market where less value flows. And an audit is not a guarantee, as anyone tracking the non-EVM audit gap knows; several of the bridges in the table above had been reviewed before they broke, because the failures lived in keys and operations rather than in the reviewed code.

There is also a quieter risk that cuts across every model on the spectrum: administrative and upgrade keys. Many bridges, intent settlement contracts, and even native rails ship with privileged functions that can pause the system, swap out a verifier set, or upgrade the code outright. Those keys are a bridge of their own, and if they sit behind a thin multisig they reintroduce exactly the single-point risk the fancy verification was meant to remove. When you size up a cross-chain route, the governance keys deserve as much scrutiny as the headline trust model.

Verifying instead of trusting

The end state everyone gestures at is a bridge that trusts nothing but math. Light clients and zero-knowledge proofs aim to let the destination chain check a cryptographic proof of the source chain’s state directly, replacing a committee of signers with a verifiable computation. Cosmos has run light-client-based transfers between chains for years, and projects like Polyhedra’s zkBridge push the same idea toward Ethereum and beyond by relaying provable block headers rather than trusting an attestation network.

The appeal is obvious: if the destination can verify the source itself, there is no smaller system to lie to, which is precisely the failure Fisch described. The catch is cost and complexity. Generating and verifying proofs for arbitrary chains is expensive and hard to implement correctly, and an implementation bug in the prover or verifier is its own attack surface. For now, ZK verification is spreading fastest where the value justifies the engineering, and it coexists with intents and native issuance rather than replacing them. The direction of travel, though, is unmistakable: from trusting people to verifying proofs.

The market is already repricing bridge security

You do not have to take any of this on faith, because capital has been voting. After the KelpDAO exploit drained roughly 292 million dollars in April 2026 by abusing a single-verifier configuration, large holders began moving assets off LayerZero and onto Chainlink’s CCIP, which secures each route with a network of independent node operators and a separate risk-management layer designed around defense in depth rather than a single point of trust. What started as a trickle became a stampede. By mid-2026, more than 7 billion dollars had migrated as Mantle joined, and several tallies put the running total near 15 billion dollars after BitGo moved its wrapped Bitcoin and issuers like Lombard, Solv, and Kraken followed.

Chainlink’s Johann Eid framed the exodus as a continued flight to safety when the first 4 billion dollars moved. Whatever you make of the branding, the signal is clear: institutions treating cross-chain security as a first-class risk are willing to migrate billions to get a better trust model. The market has decided that how a bridge verifies is not a technical footnote; it is the product.

How to read a cross-chain route before you use it

For a normal user, the takeaway is not to memorize every architecture but to ask a handful of questions before sending funds through anything that calls itself a bridge. The answers tell you what you are actually trusting.

• Will you receive a native asset or a wrapped IOU? Native USDC through a burn-and-mint rail is a fundamentally different risk than a wrapped token backed by a lockbox.
• Who or what verifies your deposit: a committee of signers, an attestation network, a solver plus settlement contract, or a cryptographic proof? The fewer people you have to trust, the better.
• If it uses a verifier set, how many independent parties, and can one of them act alone? A single verifier is the configuration that lost 292 million dollars in April.
• Are you signing an intent that a solver fills from its own funds, or approving access to a shared pool? Intents keep the risk on the solver, not on you.
• What is the recovery history? Some protocols have deep-pocketed backers or coalition rebuilds; others simply vanish. Ask whether a loss could realistically be undone, a question our look at the rollback debate after oracle attacks examines in depth.

If a route cannot give you clear answers to those questions, that opacity is itself the answer.

Why the SEC cannot refund your bridge loss

When a bank fails, a regulator steps in and depositors have recourse. When a bridge fails, there is usually no one to call. A bridge is software; once deployed, much of it runs without an operator who can reverse a transaction, and the assets often move to chains and mixers faster than any authority can react. That is why the recovery stories that end well, Poly Network’s near-total return, Wormhole’s backstop by Jump Crypto, KelpDAO’s coalition rebuild, and now Liquid’s partial white-hat return, all came from private actors, not from an enforcement agency.

The KelpDAO episode is the clearest recent template. Rather than pass losses to users, a coalition of DeFi projects including Aave and Mantle rebuilt the missing rsETH backing over about five weeks, restoring the peg without a public bailout and without a regulator. It worked because deep-pocketed players chose to step in, an option available to a handful of blue-chip protocols and almost no one else. For everyone else, a lost bridge deposit is usually just lost.

US regulators have leaned on the tools they do have, with mixed results. The Treasury sanctioned the Tornado Cash mixer in 2022, citing billions in laundered funds including proceeds from Ronin, Harmony, and Nomad. A federal appeals court later found the agency had overstepped its authority in sanctioning immutable smart contracts that no one controls, and Treasury delisted the protocol in 2025, even as criminal cases against individual developers proceeded. The Securities and Exchange Commission and the CFTC have spent 2026 sorting out which crypto assets are even securities, a boundary our coverage of the commodity-or-security gate tracks closely. None of that helps a user whose wrapped tokens turned into a claim on an empty vault. The uncomfortable truth is that in cross-chain crypto, security is prevention, because there is rarely a refund.

Where cross-chain security is heading

Bridges are not disappearing. The long tail of assets and chains will always need a way to connect, and lock-and-mint will survive at the edges. But the center of gravity in 2026 has clearly shifted. The designs winning capital and adoption are the ones that shrink or delete the thing attackers target: intents that replace a locked vault with a solver’s own funds, native issuance that removes the wrapped IOU entirely, and cryptographic verification that swaps a committee for a proof.

The Liquid incident is a fitting bookend. It was a textbook federated-multisig failure, the oldest trust model on the spectrum, and it happened to a serious team running serious infrastructure. That most of the money came back is a small mercy and not a strategy. The strategy, increasingly, is to build systems where an afternoon’s mistake cannot cost 320 million dollars in the first place, because there was never a single pot that large to lose. Verify, do not trust; and where you can, do not bridge at all.

Frequently Asked Questions

What is the safest way to move crypto across chains in 2026?

For major assets, the safest routes avoid a locked collateral pool altogether. Native issuance rails like Circle’s CCTP burn a token on one chain and mint the real asset on another, with no wrapped IOU to break, while intent-based systems such as Across let a solver front you funds from its own inventory rather than trusting a shared vault. For everything else, prefer bridges that verify with many independent parties or cryptographic proofs over those secured by a small multisig.

Are intents-based bridges actually safer than lock-and-mint bridges?

They remove the biggest single point of failure, which is the pooled honeypot of locked collateral. In an intent system, the capital at risk per transfer is a solver’s own working funds, so a compromised or insolvent solver hurts that solver rather than every user. The trade-off is that intents still depend on an underlying settlement and messaging layer that must verify your deposit, and a network dominated by a few solvers raises questions about centralization and transaction ordering.

Why do crypto bridges keep getting hacked?

Because the expensive failures are almost never plain smart contract bugs. TRM Labs found that infrastructure, key, and operational compromises drove roughly three-quarters of stolen value in the first half of 2026. Bridges hold large pots of collateral and rely on a smaller system, a multisig or an attestation network, to report what happened on another chain. Compromise those keys or feed that system false data, and the bridge will approve a theft while working exactly as designed.

Did Blockstream’s Liquid Network recover the 4,000 BTC?

Mostly. After Blockstream patched the range-proof bug in the Elements software, the attackers, who called themselves white hats, returned about 3,400 of the roughly 4,000 BTC and held back close to 600 BTC, near 47 million dollars at the time, which they framed as a self-awarded bounty. Liquid resumed block production on September 10, 2026, and Blockstream’s Adam Back said the L-BTC peg would be covered, though the shortfall left the peg operations cautious.

Can the SEC or another regulator recover funds lost in a bridge hack?

Almost never directly. A bridge is software with no operator to force a refund, and stolen funds usually move across chains and through mixers faster than authorities can act. The recoveries that happen come from private backstops, coalition rebuilds, or white-hat negotiations, not from an enforcement agency. Regulators can sanction laundering tools and prosecute individuals, but that does not make a user whole, which is why prevention matters far more than recourse in cross-chain crypto.

Yuki Tanaka is a DeFi and on-chain infrastructure correspondent at HOGE Wire, covering cross-chain security, intents, and the plumbing that moves value between blockchains.