Crypto Bridges Split in Two: The 2026 Flight to Safety

The week bridge security split in two

On November 4, 2026, ApeChain said it was ripping out LayerZero and rebuilding its cross-chain stack on Chainlink’s Cross-Chain Interoperability Protocol, making CCIP the canonical bridging standard for the Bored Ape Yacht Club and the rest of the Yuga Labs ecosystem. Five days later, on November 9, an attacker drained roughly $304,500 from Ankr’s Ethereum bridge using a single recycled deposit and five forged withdrawal receipts, according to crypto.news. The next morning, the cross-chain protocol Across told users to stop touching its app after about $294,000 vanished in what the team called a suspected domain hack.

Those three events, inside a single week, are the whole story of bridge security in 2026. The biggest and most valuable flows are consolidating onto a shrinking set of hardened, defense-in-depth rails. The long tail of smaller, app-specific bridges keeps getting drained the same way it has since 2022. And a third group, the genuinely trust-minimized designs, increasingly chooses to switch itself off rather than take a risk: in that same stretch, Threshold’s tBTC sat through a nine-day precautionary pause over a Linux kernel bug, moved no funds, and lost nothing.

Call it the great sorting. After a year in which cross-chain exploits again sat near the top of the loss tables, the market has stopped treating all bridges as one thing. This piece explains what a bridge actually does, why the job is so hard to get right, where the money really goes, and how the safer half of the industry is being rebuilt, with a practical checklist at the end for deciding whether a given bridge deserves your coins.

What a bridge is, and why it becomes a honeypot

A blockchain cannot see outside itself. Ethereum has no native way to know what happened on Solana; Bitcoin has no idea that your coins were just deposited on an Ethereum layer-2. A bridge is the machinery that lets value and messages move between these separate systems, and almost every design reduces to the same trick: lock or burn an asset on the source chain, then mint or release a representation of it on the destination chain.

The most common pattern, lock-and-mint, is also the one that builds a target. You deposit real ETH into a contract on chain A, the bridge mints a wrapped IOU on chain B, and the real ETH sits in the lock contract until someone burns the IOU to redeem it. The consequence is structural: every lock-and-mint bridge accumulates a pile of real collateral that backs all the wrapped tokens in circulation. The more useful the bridge, the bigger the pile, and a few of the largest have at times held well over a billion dollars at once. A honeypot is not a bug in this model; it is the model.

Vitalik Buterin flagged the ceiling on this years ago. His argument, posted in January 2022, was that the future would be multi-chain but not cross-chain, because there are fundamental limits to the security of bridges that hop across zones of sovereignty. Assets held on their native chain are safe up to that chain’s own security budget; the moment they are locked in a bridge and represented somewhere else, they inherit the weakest link in the whole path, and a 51% attack or a validation flaw anywhere in the chain of custody can unwind them. Nearly five years of hacks have mostly proved him right.

The stakes are easy to state. When researchers tally the worst losses in crypto history, bridges and the wrapped tokens they mint occupy most of the top spots, and that is not a coincidence. A bridge is the rare place where a single successful lie can unlock a nine-figure pool in one transaction, with no bank to call and no chargeback to file. Guarding that pool, or getting rid of it, is the central problem the rest of this piece is about. Everything that follows is a different answer to the same question: how do you stop a machine from minting money against a deposit that never really happened?

The only job that matters: verification

Strip away the branding and a bridge has exactly one job: to answer a yes-or-no question honestly. Did the deposit really happen on the source chain, for that amount, to that recipient, exactly once? Three properties hide inside that question, and a safe bridge has to nail all three: the event must be authentic (it really occurred), it must be final (it will not be reversed by a reorganization), and it must be unique (it cannot be counted twice). If the destination side mints tokens on the strength of a wrong answer to any of them, the collateral stops backing anything and the pile walks out the door.

The uncomfortable truth, as Espresso Systems chief executive Ben Fisch put it after the year’s largest bridge loss, is that most bridges do not fully verify what happened on another chain; instead, they rely on a smaller system to report it, and that system becomes the thing you trust. When that reporting layer can be fooled, the bridge does not crash or throw an error. In Fisch’s words, it worked as designed; it just believed the wrong information.

That one sentence explains most of the catastrophic losses of the last two years. The signatures were valid. The multisig quorum was met. The contract executed exactly as written. The system simply authorized a mint against an event that never happened, or that happened only once and was then replayed. Verification, not code elegance, is the whole game, and it is the part that bridges keep getting wrong.

Anatomy of the Ankr hack: a forged receipt

The Ankr exploit on November 9 is a near-perfect miniature of the problem. Early that morning, between roughly 3:09 and 3:12 Eastern Time, an attacker submitted five withdrawal requests to Ankr’s Ethereum cross-chain bridge. Each one pointed back to a genuine deposit: a tiny 0.0044 ankrETH transfer made on Optimism on November 3 that had already been redeemed once. The attacker reused that same deposit reference but rewrote the receipt details to name different recipients, larger amounts, and different tokens.

The requests passed. As one forensic account of the attack put it, the signatures on those receipts were valid; the bridge never confirmed that the signed details matched a real, unspent event on the source chain. By the time Blockaid and on-chain watchers flagged the outflow, the bridge had released roughly $304,500: about 82.91 ankrETH worth $216,370, 515,206 ankrPOL worth $56,372, and 7.98 million ANKR worth $30,857, plus smaller amounts of two other wrapped tokens, per on-chain data. The uniqueness property had failed: the same deposit was spent again and again.

Nothing here required stealing a key, breaking cryptography, or finding a clever reentrancy bug. The attacker fed the bridge a lie in the exact format it expected, and the bridge, lacking a check that each signed receipt corresponded to a unique, unspent source-chain deposit, believed it. This is Fisch’s believed-the-wrong-information failure in its cheapest possible form, and it is the same shape as losses a thousand times larger.

The trust spectrum: who you are really trusting

Not all bridges ask you to trust the same thing. The useful way to compare them is by one question: who or what has to be honest, and how hard is it to corrupt that party? From most trusting to most trust-minimized, the landscape sorts into a handful of models.

The models at the top are cheaper, faster, and easier to launch, which is exactly why the long tail lives there. The models at the bottom push the trust into mathematics and the chains’ own consensus, which is more expensive and slower to build but far harder to lie to. The same cryptographic advances that now let a phone verify a zero-knowledge proof in seconds are part of what makes zk light-client bridges plausible at all. As 1inch co-founder Sergej Kunz put it bluntly, as long as we rely on validator-based bridges, these problems will continue.

Keys, not code: what the 2026 data shows

The headline shift of the last two years is where the money is actually lost. It is no longer mostly clever smart-contract exploits; it is compromised keys, operators, and the off-chain machinery around the contracts. Reviewing the first half of 2026, TRM Labs counted a record 207 hacks but found that infrastructure, key, and operational compromises made up only about 15% of incidents while accounting for roughly 76% of all value stolen. In other words, the rare attack that gets into the plumbing does nearly all the damage.

The second half did not get calmer. CertiK’s third-quarter report put losses at about $1.26 billion across 247 incidents, up almost 54% from the prior quarter, with September alone near $766 million, the worst month of the year, and year-to-date losses past $2.68 billion. CertiK co-founder Ronghui Gu keeps repeating the lesson this shift teaches: a protocol can pass a flawless code audit and still lose millions because of a compromised admin key.

Bridges sit right in the crosshairs of that trend, because a bridge is mostly off-chain machinery, relayers, signers, oracles, and databases, wrapped around a thin on-chain contract. The table below shows the landmark losses and how few of them were really about broken Solidity.

Liquid Network is the archetype of the modern failure. In September, eleven of its fifteen federation functionaries signed a peg-out that drained roughly $320 million, yet none of them was compromised and the multisig worked exactly as intended. The real fault was a cache-key collision in the proof-verification code that let a fake proof reuse a cached valid verdict, so the honest signers authorized a withdrawal that the chain’s consensus had already, wrongly, accepted as real. In Blockstream’s own post-incident assessment, the exploited flaw had been introduced by an earlier bug fix, and no reviewer caught it before the attacker did. Honest signers plus a false premise still equals a drained vault.

The long tail that keeps breaking the same way

The small 2026 losses, Ankr and Across among them, rarely make international headlines because the dollar figures are modest. They matter because they are so repetitive. From August to November, a parade of mid-sized bridges fell to the same handful of mistakes. Coreum’s XRP bridge lost almost its entire reserve in August when relayers trusted a transaction memo instead of confirming the real payment destination, letting an attacker register phantom deposits despite a 17-of-28 quorum. Verus was drained twice in 66 days through the same unpatched import path. Allbridge was hit again after a fix it had built for one chain was never ported to another.

Why do the lessons not propagate? Partly economics, partly incentives. Kunz describes the pattern from the builder’s side: security is often not the top priority, because teams focus on launching quickly, growing users, and increasing total value locked. A validator-set bridge is fast to ship and easy to reason about, so new projects keep choosing it and keep inheriting its failure modes. Every new connection, in Fisch’s phrase, adds more assumptions, and when many bridges lean on the same thin reporting layer, you have not reduced risk, you have just copied it.

The contagion risk is real because wrapped assets rarely sit still. When KelpDAO’s rsETH lost its backing in April, the damage did not stop at the bridge: rsETH was collateral across lending markets, so the forged message rippled into Aave and forced a coalition bailout to keep the token whole. Kunz’s warning that other platforms may treat a hacked asset as legitimate, and that this is how contagion happens, is why a $292 million bridge loss can threaten far more than $292 million. KelpDAO’s operator later sued LayerZero over the design; LayerZero co-founder Bryan Pellegrino called the claim meritless and said he would defend it, and no court has ruled.

The flight to safety: billions move to a few rails

The other half of the story is consolidation. After the KelpDAO loss in April, large holders and whole ecosystems began migrating to Chainlink’s CCIP, and the trickle became a flood. By its third-quarter review the protocol reported more than $15 billion in tokenized value migrated onto it during 2026 and more than $85 billion in total cross-chain value secured. Chainlink’s Johann Eid framed the exodus simply, as a continued flight to safety.

November added two marquee names, and the table below places them in the wider 2026 migration.

On November 4, ApeChain said it was adopting CCIP as its canonical cross-chain standard across the Yuga Labs ecosystem, upgrading APE and USDC to Chainlink’s Cross-Chain Token format. A day later, OlympusDAO confirmed that proposal OIP-198 had passed and that OHM bridging was moving to CCIP across seven chains, from Ethereum and Base to Solana. The BitGo move is worth dwelling on, because it shows institutions treating bridge choice as a first-class risk decision rather than a technical footnote: the newly public, chartered custodian routed more than $7 billion of wrapped Bitcoin onto CCIP specifically to get a stronger trust model. When the entity holding the collateral picks the rail, the rail’s security becomes the product.

The institutional pull is the quiet engine under all of this. CCIP now connects dozens of blockchains and has been integrated with traditional banking messaging rails, so for a tokenized-asset issuer the choice of bridge is also a compliance and counterparty decision, not just an engineering one. That is why a state body like Wyoming’s stablecoin commission ran a formal security review before moving its Frontier Stable Token, and why the broader migration reads less like a fad and more like risk managers doing their jobs. The long tail, by contrast, is mostly retail-facing apps that never had a risk committee to answer to.

What defense in depth actually means

Flight to safety only makes sense if the destination is genuinely safer, so it helps to be concrete about what the hardened rails do differently. The common thread is that no single component is trusted to be honest; verification is layered, so one compromised piece is not enough to move the money.

CCIP, for example, runs each transaction through more than one independent network of nodes and then adds a separate Risk Management Network whose only job is to watch for anomalies and halt cross-chain traffic if the numbers stop reconciling. Chainlink describes the posture as defense in depth rather than blind trust. LayerZero’s V2 reaches for the same idea from a different direction, letting applications configure a set of Decentralized Verifier Networks and requiring an agreement of X out of Y of N verifiers before a message is accepted, so a treasury can demand many independent attestations where a game might accept one. The catch is that a default configuration can leave an application trusting a single verifier, which is precisely the setup that cost KelpDAO $292 million.

Just as important are the mundane operational controls borrowed straight from traditional finance: rate limits, circuit breakers, and timelocks. OlympusDAO’s new configuration is a clean example. The migration sets explicit per-route rate limits (on several chains, a ceiling near 100,000 OHM at a time), keeps a lock-and-release pool for canonical OHM on Ethereum, and uses burn-and-mint pools on the destination chains. A rate limit will not stop a determined attacker outright, but it caps the blast radius: it turns a total drain into a partial one and buys the humans time to reach the kill switch. Nomad lost $190 million in a chaotic free-for-all in 2022 precisely because nothing throttled the outflow once the door was open, and dozens of opportunists piled in by copying the attacker’s transaction.

Deleting the honeypot: native issuance

The most durable fix is not to guard the honeypot better but to remove it. If a token can be destroyed on the source chain and freshly issued on the destination chain by its own issuer, there is no locked pile of collateral to steal in the first place.

Circle’s Cross-Chain Transfer Protocol does exactly this for USDC. Rather than lock dollars in a bridge and mint a wrapped version, it burns native USDC on the origin chain and mints native USDC on the destination, with Circle attesting to the burn. There is no third-party lock contract holding billions, so the classic bridge honeypot is simply not there. The same logic drives the canonical bridges that rollups run to Ethereum, and the growing use of issuer-controlled standards like xERC-20 that let a token’s own team decide which bridges may mint it, and how fast.

This is why so much of the 2026 migration is really a migration toward native issuance. ApeChain upgrading its assets to Chainlink’s Cross-Chain Token standard, Circle minting USDC natively across chains, and issuers reclaiming mint rights from third-party bridges are all versions of the same move: shrink or delete the pooled collateral that made bridges worth attacking in the first place. You cannot drain a vault that was never filled. The trade-off is a different kind of trust, since the issuer now holds the mint switch, but for assets like USDC that are already centrally issued, it removes a layer of risk rather than adding one.

When the safe move is to stop: tBTC’s pause

There is a third posture, and November produced a clean example of it. Threshold’s tBTC is a trust-minimized Bitcoin bridge: moving the underlying BTC requires signatures from a majority of a large set of independent operators, so no single operator can touch the reserve. In late October a serious Linux kernel vulnerability, CVE-2026-98432, was disclosed, a use-after-free bug in the kernel’s IPv4 handling that could in theory let an attacker run code on the servers those operators rely on.

Threshold’s response was to pause. New minting and redemptions were halted while every tBTC operator patched its servers or took nodes offline, and the bridge stayed in that defensive crouch for about nine days before on-chain operations resumed. The network reported no evidence that the flaw had ever been used against its nodes, and throughout the pause its roughly 4,320 BTC of reserves kept backing the roughly 4,185 tBTC in circulation, according to Threshold’s own disclosures. The cost was real but bounded: Aave’s tBTC market, holding about $120 million, was restricted to new deposits and borrowing until normal operation returned, an inconvenience rather than a loss.

Compare that to Ankr and Across, which learned about their problems from security alerts after the money was already gone. A bridge that can choose to switch itself off before an exploit, and that loses nothing by doing so, is operating on a different plane from one that cannot even see the attack until the outflow lands on a dashboard. Willingness to pause is itself a security feature, not an admission of weakness, and it is one of the cleanest signals that a team treats user funds as something to protect rather than a growth metric.

Intents and chain abstraction: the bridge disappears

The newest layer tries to take the bridge out of the user’s hands entirely. Instead of asking you to pick a bridge, sign a lock transaction, and wait, an intents system lets you state an outcome (say, 1,000 USDC on Base, starting from ETH on Arbitrum) and lets a competitive network of solvers work out how to deliver it, usually by fronting the funds on the destination chain and settling up afterwards.

Protocols such as Across pioneered this model, and the emerging ERC-7683 standard aims to make intents portable across solvers and chains. The user experience is dramatically better, and fees often fall as solvers compete. But it is worth being honest about what moved rather than what vanished: the trust did not disappear, it relocated. You are now trusting the settlement layer that reimburses solvers and the canonical bridges or messaging rails underneath, which is why serious intents systems still settle over the same hardened infrastructure, and why liquidity provision for solvers looks a lot like the automated market maker design that powers on-chain trading. Chain abstraction hides the bridge; it does not abolish it.

That hiding is both the appeal and the risk. A smoother flow means users think less about what they are trusting, which is fine when the plumbing is one of the hardened rails and dangerous when it quietly routes through an unaudited validator-set bridge. The convenience is real; so is the temptation to stop asking the one question that matters, which is what, exactly, is verifying that your deposit happened.

Laundering, Lazarus, and what the SEC can and cannot reach

Behind the biggest bridge thefts stands a now-familiar culprit. North Korea’s Lazarus Group, through units that US investigators track as TraderTraitor, was tied this year both to the forged-message attack on KelpDAO and to the single largest crypto theft on record: the roughly $6.3 billion drained from Binance on October 29, which TRM Labs assessed with high confidence was North Korean work. Bridges are central to what happens next, because moving stolen value across chains is how attackers break the forensic trail. Research from Global Ledger found that cross-chain bridges have overtaken mixers as the leading laundering channel for stolen crypto, and investigators have tracked the Binance proceeds being churned through freshly minted tokens and liquidity pools across several networks.

For users and builders this raises an awkward legal question that the wave of enforcement has only partly answered. In the United States, the SEC and the CFTC police the tokens and the intermediaries, and the Treasury’s Office of Foreign Assets Control can sanction wallet addresses and mixing services, as it did with Tornado Cash. But code is not a company. The 2025 conviction of Tornado Cash co-founder Roman Storm for running an unlicensed money-transmitting business, even as jurors deadlocked on the laundering counts, set the tone: regulators increasingly pursue the people and the front-ends they can reach, not the immutable contracts they cannot. Tracing stolen funds across chains has become a surveillance discipline in its own right, the subject of a fast-growing on-chain analytics industry.

The regulatory calendar matters too. After the midterm results reshuffled Washington, the market’s attention has narrowed to a cluster of December deadlines on market-structure legislation that will decide, among other things, which agency supervises the plumbing that bridges depend on. For now the practical takeaway is blunt: if a bridge you use is drained, recovery is the exception, not the rule, and no regulator is going to make you whole.

How to bridge in 2026 without getting burned

You do not need to read Solidity to make better bridge choices. A handful of questions filters out most of the risk.

• Prefer native issuance. If an asset can be moved by its own issuer (native USDC through CCTP, or a token using Chainlink’s CCT standard or xERC-20), there is no third-party honeypot to drain. Favor it over a wrapped IOU.
• Ask what verifies the transfer. A single operator or a small multisig is the weakest setup; a defense-in-depth rail with an independent risk network, or a light-client or zk design, is far harder to lie to.
• Check for rate limits and a pause switch. Per-route caps, circuit breakers, and a team that has shown it will halt (as tBTC did) bound your losses when something goes wrong.
• Use the canonical bridge for layer-2s. Moving between a rollup and Ethereum, the chain’s own canonical bridge is almost always safer than a third-party alternative, even when it is slower.
• Verify the URL and bookmark it. The Across incident was a front-end compromise, not a contract bug. Type the address yourself, confirm the domain, and treat any unexpected approval prompt as a red flag.
• Do not park size in wrapped assets. Bridge what you need, when you need it, then move on. A wrapped token sitting idle is pure counterparty risk for no yield.

Independent trackers such as L2BEAT publish the trust assumptions of major bridges in plain language, including who can upgrade the contracts and how quickly. Reading that page before you move serious value is fifteen minutes well spent. The sorting now under way rewards exactly this kind of attention: the safe half of the bridge world is getting safer, and the dangerous half is advertising itself to anyone who bothers to look.

Frequently Asked Questions

Are crypto bridges safe to use in 2026?

It depends entirely on the bridge. The hardened rails that large institutions migrated to this year, defense-in-depth messaging networks like Chainlink CCIP and native-issuance systems like Circle’s CCTP, are far safer than the single-operator and small-multisig bridges that keep getting drained. The safest transfer of all uses a token’s native issuer or a chain’s own canonical bridge, because there is no pooled collateral for an attacker to steal.

Why do cross-chain bridges get hacked so often?

Because a bridge’s one job, verifying that a deposit really happened on another chain, is genuinely hard, and most bridges outsource it to a small set of off-chain signers or relayers that can be fooled or compromised. In the first half of 2026, infrastructure and key compromises caused only about 15% of incidents but roughly 76% of the value stolen, according to TRM Labs. A bridge usually does not get hacked because its code is broken; it gets hacked because it believed false information.

What was the Ankr bridge hack?

On November 9, 2026, an attacker drained roughly $304,500 from Ankr’s Ethereum bridge by reusing a tiny, already-redeemed deposit from Optimism and submitting five forged withdrawal receipts with altered recipients, amounts, and tokens. The signatures were valid, but the bridge never confirmed that each receipt matched a unique, unspent deposit on the source chain, so it released ankrETH, ankrPOL, and ANKR to the attacker.

Is Chainlink CCIP safer than LayerZero?

Both use layered verification, but they differ in design. CCIP adds a separate Risk Management Network that can halt transfers when it detects anomalies, which is part of why more than $15 billion in value, including ApeChain, OlympusDAO, BitGo’s WBTC, and Wyoming’s state stablecoin, migrated to it in 2026. LayerZero V2 lets each application configure its own verifiers and threshold. The honest answer is that a bridge is only as safe as its specific configuration, so judge the settings, not the brand.

How can I tell if a bridge is safe before I use it?

Ask what verifies the transfer, since a single operator is the weakest setup, and prefer native issuance or a canonical layer-2 bridge. Check for rate limits and a demonstrated willingness to pause, and confirm you are on the correct URL, because some attacks target the front-end rather than the contract. Independent trackers like L2BEAT document who controls each bridge and how fast they can change it, which is the quickest way to judge its trust assumptions.

Daniel Voss covers cross-chain infrastructure and on-chain security for HOGE Wire.