Twice Is a Pattern: Why Bridge Hacks Keep Repeating in 2026

On 23 July 2026, an attacker drained the Verus Protocol Ethereum bridge of about $7.5 million in ETH, tBTC, stablecoins and other assets. The mechanics were grimly familiar, because they had already happened. Sixty-six days earlier, in May, the same bridge, through the same contract and the same entry path, had lost roughly $11.5 million to a different attacker using a fresh wallet. The team recovered most of the May funds under a white-hat deal, redeposited them, and then watched the bridge get emptied again almost immediately, according to security firm Blockaid analysis reported by The Block.

That is the uncomfortable center of any honest bridge hack analysis in 2026. Cross-chain bridges are not failing in surprising, novel ways. They are failing in the same small set of ways, over and over, and sometimes to the same protocol within weeks. The post-mortems get written, the root causes get named, the fixes get promised, and then the next bridge, or the same one, loses another eight or nine figures to a failure mode the industry has understood since 2021.

This is not a chronology, and it is not a how-it-works explainer. It is an argument: the defining feature of bridge security is recurrence. Two bridges were drained the same way twice in 2026, months apart. Zoom out, and a decade of headline bridge hacks collapses into a short menu of failure modes that keep coming back. Understanding why they repeat, and why the lessons so rarely spread, is more useful than memorizing one more incident.

The clearest tell: two bridges hacked the same way twice

Begin with the literal repeat offenders, because they remove any doubt about whether the industry acts on its own autopsies. Most of the time, when a bridge is exploited a second time, defenders can argue the two events were unrelated: a different chain, a different contract, a different class of bug. In 2026 that excuse ran out. Two separate bridges were hit by essentially the same attack twice, once as a warning, and once after the warning had been read, written up, and supposedly patched. The gap between the two Verus incidents was measured in weeks. The gap between the two Allbridge incidents was measured in years, which is arguably worse, because it means the fix existed and simply never traveled.

Verus: the same door, 66 days apart

The Verus Ethereum bridge moves value by having each chain notarize what happened on the other. In May 2026 an attacker exploited a flaw in how that notarization data was validated, forging import proofs to authorize withdrawals the bridge should never have signed off on. The loss was around $11.5 million. DeFi Planet reported that the underlying fix amounted to roughly ten lines of Solidity, the kind of change a competent team can ship in an afternoon, per DeFi Planet. The May attacker even behaved like a negotiator, returning most of the funds and keeping a 25% bounty.

Here is where the story stops being ordinary. The recovered funds were redeposited into the bridge on 8 July. On 23 July the bridge was drained again, this time for about $7.5 million, using the same contract, the same entry path, and the same vulnerability class, according to Blockaid via The Block. The second attacker was different, working from a fresh wallet, which means the flaw was public enough, or discoverable enough, that a second party found and weaponized it within nine weeks. The combined damage reached about $19.1 million across the two events, as Bitcoin.com News tallied it. The July funds were laundered through a relay service and Tornado Cash, and Verus, unlike some peers that raced to publish bounty offers, said very little publicly.

The Verus case is the purest example of the pattern this article is about. The bug was found, the money was returned, the bridge was refilled, and the door was left open. Recovery got mistaken for resolution.

Allbridge: a fix that was written down and never shipped

If Verus shows how fast a bug can recur, Allbridge shows how a lesson can be documented in detail and still fail to reach a second deployment. In April 2023, Allbridge lost about $570,000 when an attacker used a flash loan to skew the ratio of a liquidity pool on BNB Chain and drain value on favorable terms. The team recovered roughly $465,000 through a white-hat arrangement and, crucially, published a fix: run a single liquidity pool per chain so that no attacker can pit two pools against each other inside one transaction, plus add a rebalancer authority and an automatic shutdown trigger.

That fix was never extended to the Solana deployment. On 19 July 2026, Allbridge Core lost about $1.65 million on Solana when an attacker took a $1.12 million flash loan from the lender Kamino and manipulated a side-by-side USDC and USDT pool, exactly the configuration the 2023 post-mortem said it had eliminated. CryptoTimes flagged it plainly as the second such hit since 2023, and The Block confirmed the mechanics. Allbridge paused the protocol, asked arbitrageurs to return their profits, and announced that Core and Classic would shut down within three months, with a relaunch that drops liquidity pools entirely in favor of Circle CCTP and LayerZero routing.

The Solana relaunch plan is the right call. But it also confirms the failure: the safer architecture was already known in 2023. It simply never propagated to every place Allbridge ran the same risky design.

Literal repeats versus structural repeats

Verus and Allbridge are literal repeats: same protocol, same flaw. They are the loud version of the problem. The quiet version is the structural repeat, where different protocols with different codebases fail in the same way, for the same underlying reason, years apart. The literal repeats are the alarm. The structural repeats are the disease.

Look at the full roster of headline bridge hacks since 2021 and they sort neatly into about four buckets. The signers get compromised. The bridge is fooled into believing something false about another chain. A code, configuration, or consensus bug makes an invalid message look valid, and the honest validators cannot override it. Or the operator behind a nominally decentralized bridge simply collapses. Almost nothing in the roster is a genuinely new idea. Vitalik Buterin warned about the ceiling as early as January 2022, arguing there are fundamental limits to the security of bridges that hop across multiple zones of sovereignty. A bridge is only ever as trustworthy as the weakest of the systems it spans, and that ceiling has not moved much. The next four sections walk each bucket.

The distinction matters because it tells a defender where to look. A literal repeat is a process failure: someone owned the bug, closed the incident, and never verified the patch reached production, or never checked whether a sibling deployment carried the same flaw. A structural repeat is a design failure: the trust model itself has a known soft spot that keeps getting rebuilt because shipping it is cheaper and faster than the safer alternative. Fixing the first takes discipline. Fixing the second takes a new architecture, which is exactly the harder and more expensive path teams tend to defer.

Failure mode one: the signers fall

The most expensive bridge hack in history is still one where the signers lost control of their keys. In March 2022 the Ronin bridge that supported Axie Infinity was drained of about $625 million, per CoinDesk. On paper it used a five-of-nine validator multisig. In practice, Sky Mavis controlled four validators directly and a fifth had delegated its emergency signing back to Sky Mavis during a 2021 traffic surge and never revoked it, so compromising one organization yielded five signatures. The keys were taken through a fake job offer laced with malware, the signature of the Lazarus Group. The threshold looked robust and meant almost nothing, because the signers were not independent.

Harmony repeated the theme three months later, losing about $100 million from a bridge secured by only a two-of-five multisig, again attributed to Lazarus, per CoinDesk. Four years on, the class was still alive: in July 2026 the Arbitrum-based venue AFX Trade lost $24.15 million after its validator signing keys were compromised, with five signatures clearing a roughly two-thirds quorum inside a dispute window too short to catch, per CoinDesk. Arbitrum co-founder Steven Goldfeder was quick to note that Arbitrum native bridge had not been exploited; the vulnerable layer was the one AFX built on top.

The recurrence has a simple root. Keys leak through people: fake recruiters, poisoned pull requests, malware on a developer laptop or phone. That is a human and endpoint problem more than a cryptographic one, which is why security desks now treat a signer device as a high-value target in its own right, a theme our colleagues explored in The Phone Is the Vault. Raising the signature threshold is theater if any one party can reach the quorum, or if the same phishing email can reach several signers at once.

Failure mode two: the bridge believes a lie

The second bucket is subtler and, in 2026, the most instructive. Here the signers are honest and the keys are safe. The bridge is simply told something false about another chain, and it acts on it. Wormhole is the archetype: in February 2022 a deprecated verification routine on Solana failed to confirm that a signature account actually belonged to Wormhole guardian network, letting an attacker forge a validation message and bypass the 13-of-19 guardian requirement to mint 120,000 wrapped ETH, about $325 million, as Halborn documented in its technical breakdown. Jump Crypto refilled the hole within a day, which saved users but did nothing to change the lesson.

The 2026 restatement of that lesson was the roughly $292 million KelpDAO exploit, the largest single crypto hack of the first half of 2026. It was not a smart-contract bug at all. Attackers compromised the internal infrastructure feeding LayerZero verification layer for the rsETH deployment while denial-of-service attacks pushed traffic onto the poisoned path, and a configuration that required only a single verifier accepted a spoofed cross-chain message. OpenZeppelin titled its report on the incident, fittingly, around the fact that a full audit found nothing wrong with the code; the failure was operational, a point we covered in Zero Bugs Found. Ben Fisch, CEO of Espresso Systems, put the whole bucket in one line to CoinDesk: the bridge worked as designed, it just believed the wrong information, because most bridges do not fully verify what happened on another chain and instead rely on a smaller system to report it.

If you needed proof that quorum size is a red herring in this bucket, August 2026 supplied it. The Coreum bridge to the XRP Ledger, operated by the brand TX, was drained of about 199,916 XRP (roughly $200,000) despite a 17-of-28 relayer quorum, per The Cryptonomist. The relayers were honest and there were plenty of them. The flaw was in what they checked: the software validated a deposit by trusting the transaction memo instead of confirming the real payment destination, so the attacker registered phantom deposits by moving self-controlled wrapped tokens between their own wallets with fraudulent memos. Seventeen honest signers ratifying a lie is still a lie. A bigger committee just means more signatures on the fraud.

Failure mode three: the bug the validators cannot catch

The third bucket is the one that should keep bridge engineers awake, because in it the humans and the quorum do everything right and the code betrays them. Nomad set the template in August 2022. A routine upgrade initialized a trusted root to a blank value that happened to match the default for unproven messages, so every message validated automatically. What followed was not one theft but a crowd; Mandiant called it decentralized robbery as hundreds of unrelated wallets copied the first attacker transaction with their own addresses, draining about $190 million. Around $36 million came back under a bounty, and a key suspect was later extradited to the United States.

BNB Bridge two months later showed the same shape at larger scale: a forged IAVL proof let an attacker mint a million BNB twice over, a face value near $566 million, though BNB Chain small validator set halted the entire network within hours and froze most of it, so only an estimated $100 million to $110 million left the chain, per Halborn. And in September 2026 the pattern reached one of the oldest and most reputable federations in Bitcoin. Blockstream Liquid sidechain lost about 4,000 BTC, roughly $320 million at the time, when a cache-key collision in the Elements range-proof verification let a fake proof reuse a cached valid verdict and mint unbacked L-BTC. The federation eleven-of-fifteen multisig then dutifully signed a peg-out that looked valid, because the nodes themselves had accepted the forged proof. Bitquery reconstructed the on-chain trail, and Blockstream resumed block production on 10 September after patching, as Bitcoin.com News reported.

The Liquid case also carries the ugliest recurring detail in this bucket: the fix was already public. The commit that hardened the range-proof cache was in the Elements repository days before the exploit, while the federation ran an older release. That gap between a public fix and a deployed one, the N-day window, is itself a pattern that repeats across the industry, and it is the point at which a caught bug becomes an exploited one.

Failure mode four: the operator simply collapses

The fourth bucket is the one no clever contract can fix, because the failure is organizational. Multichain, once one of the busiest cross-chain routers in DeFi, did not lose a signature-verification argument. Its operations depended on multi-party computation infrastructure that its CEO alone effectively controlled. When he was detained by Chinese police in May 2023, the team lost access, and by July about $130 million moved to unknown addresses before the protocol shut down entirely, per CoinDesk. Later Singapore liquidation proceedings cited a figure closer to $210 million, and pieces of the stolen USDC remain frozen through court-extended orders years later.

The recurrence here is not a coding lesson at all; it is a governance one. Every bridge that concedes real operational power to a single company, a single founder, or a single cloud account inherits Multichain risk, whether or not it ever ships a line of buggy Solidity. A founder seized by police, a disgruntled insider, a bankruptcy, or a lost laptop are all the same failure from the protocol point of view: the humans who could move the money became unavailable or adversarial, and the code had no way to route around them.

Multichain marketed itself as decentralized, but its keys, and its continuity, sat with one person. That is the recurring lesson of the fourth bucket: a bridge can be perfectly coded and still fail because an off-chain single point of control was papered over with the word decentralized. The custody question, who really holds the keys and what happens when they vanish, is the same one that runs through modern exchange design, including the shift toward programmable deposit addresses we examined in EIP-7702 at the Exchange.

Why the lessons never propagate

So the failure modes are few and old. Why do they keep working? Five forces, most of them economic rather than technical.

• Config drift and deployment sprawl. A fix lands on one chain or one fork but not on the others. Allbridge Solana pools were the 2023 bug in a new venue; KelpDAO required only a single verifier after a manual downgrade of a stricter default.
• Security loses to shipping. Sergej Kunz, co-founder of 1inch, told CoinDesk that security is often not the top priority because teams focus on launching quickly. The known fix gets a ticket, not a release.
• The honeypot grows faster than the defenses. Bridges move more than $10 billion a month by some 2026 estimates, per Yellow research. A pool design that was survivable at $1 million becomes catastrophic at $300 million without a single line of code changing.
• N-day gaps. Public fixes sit unapplied, as Liquid showed. The attacker reads the same commit history the defenders do.
• Automated discovery raises the baseline. Charles Hoskinson, reacting to a July 2026 bridge hack, argued to CoinDesk that all software is under enormous assault from automated vulnerability discovery, comparing partial hardening to being ninety percent resistant to a deadly disease: expose it enough times and you still catch it.

None of these are exotic. They are the ordinary frictions of shipping software under commercial pressure, applied to systems that happen to guard hundreds of millions of dollars and cannot be quietly rolled back.

Put together, these forces explain why a bridge post-mortem so often reads like a re-run. The bug is understood. The fix is known. What is missing is the institutional muscle to make sure the fix reaches every deployment, stays applied through every upgrade, and is stress-tested before the balance climbs back into nine figures. That muscle is expensive and invisible when it works, which is precisely why it keeps losing budget fights to the next feature launch.

The numbers behind the pattern

The aggregate data says the same thing the case studies do. Chainalysis found that roughly $2 billion was stolen across 13 bridge hacks in 2022 alone, about 69% of that year’s total crypto theft, in its 2022 review. Cumulatively, bridges have absorbed more than $2.8 billion in losses since 2021, close to 40% of all value ever stolen in Web3, per Phemex research. The composition matters as much as the total. TRM Labs found that in the first half of 2026 there were a record 207 hacks and about $972 million stolen, and that infrastructure, key, and operational compromises made up only around 15% of incidents but roughly 76% of the value, per its H1 2026 report. That maps almost perfectly onto the bridge roster: very few of these were pure Solidity bugs.

Bridge-specific losses in 2026 ran past $328 million across eight to fourteen incidents by mid-year, dominated by KelpDAO, per PeckShield figures cited by CryptoTimes. The dollar totals are falling year over year, but the failure modes are not changing, which is the whole point.

What actually breaks the cycle

If the disease is recurrence, the cure has to attack it at the root, and in 2026 two strategies matured enough to matter. The first is shrinking the prize. Native issuance, where an asset is burned on one chain and minted on another rather than locked in a honeypot, removes the giant pooled balance that makes a bridge worth attacking; Circle CCTP moves native USDC this way, with no wrapped IOU, pool, or custodian, per Circle. Intent-based systems, standardized as ERC-7683 and co-authored by Across and Uniswap Labs, shrink standing balances further by having solvers fill user orders and settle among themselves, per the ERC-7683 spec. The safest bridge, increasingly, is the one that holds as little as possible.

The second strategy is raising the cost to corrupt the trust set. LayerZero V2 lets applications require several independent decentralized verifier networks in an X-of-Y-of-N configuration rather than a single one, per its documentation, and it raised its minimums after KelpDAO so that no production deployment can sit at one-of-one again. Chainlink CCIP secures each lane with a separate Risk Management Network of independent node operators, a defense-in-depth design detailed on Chainlink blog. The market has been voting on this with its feet: after KelpDAO, more than $15 billion in bridged assets migrated from LayerZero toward Chainlink CCIP, including a large WBTC move by BitGo, per CoinDesk. Further out, zero-knowledge light clients such as Polyhedra zkBridge aim to replace trusted committees with math, verifying the other chain state directly rather than asking a smaller group to vouch for it.

None of this deletes the human layer. Governance keys, social engineering, and config drift survive every architectural upgrade. Liquid is the cautionary note: an eight-year-old, reputable federation with a high multisig bar still lost $320 million to a consensus bug that the multisig could not see. Better plumbing narrows the attack surface; it does not close it.

The regulator cannot unwind it

One reason bridge hacks recur is that the deterrent side is weak. After Ronin, Harmony, and Nomad, the US Treasury sanctioned the Tornado Cash mixer in August 2022, citing more than $7 billion laundered and naming those exact bridges, per its press release, and later sanctioned the Sinbad mixer in November 2023. Then the enforcement theory ran into the same property that makes bridges hard to secure. In November 2024 the Fifth Circuit ruled that OFAC had exceeded its authority, reasoning that immutable smart contracts nobody controls are not the property of a sanctionable person, and Treasury delisted Tornado Cash in March 2025, per Forbes.

Criminal cases against people have held up better than sanctions against code. Tornado Cash co-founder Roman Storm was convicted in August 2025 of running an unlicensed money-transmitting business, with a jury deadlocked on the other counts and a retrial pushed to April 2027, per The Block. Meanwhile the SEC and CFTC issued a joint interpretation in March 2026 stating that most crypto assets are not securities, per Decrypt, which further narrows the securities-law hook for bridge losses. The practical takeaway for a user is blunt: no US regulator refunds a bridge victim, and the compliance perimeter now sits on licensed intermediaries rather than the protocol, a shift we traced in MiCA in 2026. When a bridge fails, the law offers process, not a refund.

The recovery lottery

Because there is no legal backstop, getting money back after a bridge hack is a lottery decided by who stands behind the protocol. There are four rough outcomes. A deep-pocketed backer can simply cover the loss, as Jump Crypto did for Wormhole and Sky Mavis did for Ronin. The attacker can accept a white-hat bounty, as with Poly Network almost total return, Nomad partial return, and the Verus May negotiation. A coalition can rebuild the backing, which is what a group led by Aave and Mantle did for KelpDAO over about five weeks, restoring rsETH so that no losses passed to users, per Incrypted. Or nothing comes back, as with Multichain.

The white-hat framing has become the de facto insurance policy, and it is increasingly contested. When the Liquid attacker offered to return most of the funds and keep a ten percent bounty, returning roughly 3,400 BTC and holding about 600, Ledger CTO Charles Guillemet pushed back to BeInCrypto that white hats do not drain a bridge and then solicit an on-chain contact. Blockstream CEO Adam Back, managing the fallout, urged holders not to panic sell over the counter and said the L-BTC peg would be covered one to one, per Bitcoin.com News. The deeper risk is contagion: bridged assets are routinely used as collateral elsewhere, so a fake mint on one chain can become bad debt in a lending market on another, which is why the health of a bridge is really a question about the whole credit stack, a link we unpacked in DeFi Lending in 2026. Whether users are made whole depends on a balance sheet, not a rule.

What to watch in 2027

The signals that the cycle is genuinely breaking are specific. Verifier minimums becoming a hard default rather than a per-app choice. Native issuance eating into the share of value that sits in wrapped-asset honeypots. Zero-knowledge light clients moving from testnets into production lanes that hold real money. And, most tellingly, whether the repeat offenders actually change their architecture: Allbridge dropping pooled liquidity is the right move, and the test for Verus is whether it ever shipped more than a patch. Bitcoin trading around $81,000 as of 19 September, per CoinGecko, is a reminder that the honeypots are not shrinking on their own; a 4,000 BTC federation balance is a $320 million target at these levels.

The uncomfortable conclusion of a 2026 bridge hack analysis is that the same attacks keep working because the incentives to ship fast and the economics of a growing prize outrun the discipline to apply known fixes everywhere they are needed. The failure modes are few, old, and well documented. Until verify, do not trust is the default and the prize is deliberately shrunk, 2027 will produce its own repeat offenders, and the post-mortems will read a lot like the ones already on file.

Frequently Asked Questions

Why do crypto bridges get hacked so often?

Bridges concentrate large balances in one place and rely on off-chain trust: a set of signers, validators, or nodes that vouch for what happened on another chain. If those signers are compromised, or if the reporting system they rely on can be fooled, the money moves. Analytics firm TRM Labs found that infrastructure, key, and operational compromises made up only about 15% of hack incidents in the first half of 2026 but roughly 76% of the value stolen, which is why bridges keep appearing at the top of loss tables.

What was the biggest bridge hack ever?

The Ronin bridge that supported Axie Infinity remains the largest bridge hack, with about $625 million drained in March 2022 after attackers gained control of five of nine validator keys. Poly Network lost more than $610 million in 2021, though almost all of it was returned. In 2026 the largest single losses were the roughly $292 million KelpDAO exploit in April and about $320 million drained from Blockstream Liquid sidechain in September.

Has the same crypto bridge ever been hacked twice?

Yes, and it happened twice in 2026. The Verus Ethereum bridge lost about $11.5 million in May and then roughly $7.5 million in July through the same contract and vulnerability class, 66 days apart. Allbridge was drained by a flash-loan attack on BNB Chain in 2023 and again on Solana in 2026, because the fix it promised the first time was never extended to its Solana deployment.

Are bridge hacks getting less common in 2026?

The total value stolen fell in 2026, but the pattern did not change. TRM Labs recorded a record 207 hacks in the first half of the year with about $972 million stolen, down from more than $2 billion a year earlier. Bridge-specific losses ran past $328 million by mid-2026 according to PeckShield, dominated by the KelpDAO exploit, so fewer dollars are being lost but the same failure modes keep working.

Can you get your money back after a bridge hack?

Sometimes, but there is no rule that guarantees it. Recovery depends on whether a deep-pocketed backer covers the loss, whether the attacker accepts a white-hat bounty, or whether a coalition rebuilds the backing, as Aave and Mantle did for KelpDAO. No US regulator such as the SEC refunds bridge victims, so recovery is a negotiation and a matter of the balance sheet behind the protocol, not a legal right.

Anneke de Vries is HOGE Wire’s security desk editor and has covered cross-chain exploits since 2021.