Bridge Hack Analysis 2026: It’s the Keys, Not the Code

On the evening of August 9, 2026, an attacker needed 97 minutes and 94 separate transactions to empty the cross-chain bridge linking Coreum to the XRP Ledger. By the time the relayers stopped signing, the bridge held 493 XRP; minutes earlier it had held nearly 200,000. The operator, a firm called TX, later admitted that bridged XRP on its chain was not currently fully backed. No private key was stolen. The XRP Ledger itself was never touched. The bridge simply counted deposits that never arrived, because its software checked a transaction memo and never confirmed that any money had actually shown up.

That was not a freak accident. It is the signature of almost every serious bridge failure of the past five years. Bridges are the plumbing that carries value between blockchains that cannot natively talk to one another, and they have lost more money, faster, than any other category in crypto. The reflex, every single time, is to blame buggy code. The data tells a different and more uncomfortable story.

This is an analysis of that story: what the biggest and newest hacks actually have in common, the handful of trust models that keep breaking, who ends up paying to make users whole, where the stolen money goes, and how regulators and the market are repricing the risk. It is deliberately not another timeline. The timelines have already been written. The pattern underneath them is the point.

It’s the Keys, Not the Code

Start with the numbers that reframe everything. In its H1 2026 report, TRM Labs counted 207 hacking incidents in the first six months of the year, a record, yet total losses fell to roughly $972 million, down about 57% from the $2.3 billion stolen in the first half of 2025. A record number of incidents alongside falling losses looks like a contradiction until you split the incidents by type. Smart-contract exploits made up 125 of the 207 cases, close to 60%, but caused only limited financial damage. Infrastructure and operational compromises, meaning stolen keys, hijacked servers, and social engineering of the humans who hold signing authority, were only about 15% of incidents but roughly 76% of the money.

Lay that finding over the roster of landmark bridge hacks and it fits like a template. Ronin and Harmony were stolen validator keys. Wormhole and KelpDAO were forged or spoofed messages that the bridge dutifully believed. Multichain was an operator who vanished. Coreum, this month, was software that trusted a memo. Almost none of the biggest bridge losses came from the kind of memory-safety or arithmetic bug that a line-by-line audit is built to catch. The exceptions, and there are a few, mostly prove the rule.

The cleanest way to state the thesis is this: a bridge is a machine for believing claims about another chain. Its security is the security of whoever, or whatever, is allowed to make those claims. That is a key-management and trust problem first, and a coding problem a distant second. It also explains who keeps winning. TRM tied about 66% of the half-year’s stolen funds, roughly $643 million, to North Korea, including the $292 million KelpDAO exploit and the $285 million Drift Protocol theft. The best-resourced attackers on earth go after keys and infrastructure precisely because that is where the concentrated money sits.

A Bad Five Years, By the Numbers

Bridges earned this scrutiny. Chainalysis found that roughly $2 billion was stolen across 13 separate bridge hacks in 2022 alone, about 69% of all crypto stolen that year. The reason is structural: a bridge is a honeypot by design. It holds the pooled collateral that backs every wrapped token it has ever minted, often with tens of billions of dollars in monthly flows passing through a handful of contracts and a small set of signers. Break the signers or the software that instructs them, and the whole vault opens at once.

2026 has not broken the habit. Bridge-specific losses passed $328 million by mid-May, dominated by KelpDAO, and the summer wave that followed pushed the running total past $340 million across at least fourteen tracked incidents. The individual sums range from a $625 million catastrophe to a $200,000 embarrassment, but the mechanics rhyme. These are the landmark cases that set the template, and the last column is the one worth watching.

Notice how uncorrelated that final column is with the size of the loss. The $625 million Ronin theft ended with users repaid; the $100 million Harmony theft did not. Recovery, it turns out, has almost nothing to do with how the hack happened and almost everything to do with who was standing behind the bridge when it did. Hold that thought.

Five Trust Models, Five Ways to Break

Every bridge has to answer one question before it releases funds: did the event I am being told about on the other chain actually happen? How it answers defines its trust model, and each model has a signature way of failing. Vitalik Buterin flagged the ceiling on all of this early. In a January 2022 argument that has aged well, the Ethereum co-founder wrote that there are fundamental limits to the security of bridges that hop across multiple “zones of sovereignty,” and that the future would be multi-chain but not cross-chain. Every design below is an attempt to push against that limit, and the further down the table you go, the closer a bridge gets to proving rather than trusting.

The industry’s center of gravity is drifting downward through that table, from trusting a committee toward verifying a proof. But most of the value in the market still sits on the top two rows, which is exactly where the biggest failures cluster. The next four sections walk the failure modes in order of how much damage they have actually done.

Failure Mode One: When the Signers Fall

The federated multisig is the oldest and most brittle design, and it produced the single worst theft in crypto history. The Ronin bridge behind Axie Infinity ran a 5-of-9 validator scheme, but Sky Mavis directly controlled four of those keys, and a fifth signer (the Axie DAO) had delegated its emergency signing back to Sky Mavis during a 2021 traffic surge and never revoked it. Compromising one organization was therefore enough to forge a majority. Lazarus Group did it with a fake job offer and a malware-laced document sent to a senior engineer, then walked out with about $625 million in ETH and USDC. The theft went unnoticed for six days.

Harmony’s Horizon bridge was worse on paper. Its multisig required only two of five signatures, so two compromised keys drained roughly $100 million. These are not exotic cryptography failures. They are the same category of risk that governs any high-value validator set, the sort HOGE Wire has examined through the lens of validator economics in 2026: the security of the system collapses to the operational security around a handful of private keys, and the incentive to steal those keys scales with the size of the vault behind them.

The 2026 cases show the same wound in newer skin. In July, the Arbitrum-based perpetuals venue AFX Trade lost $24.15 million when validator signing keys were compromised and the forged signatures cleared a roughly two-thirds quorum; a 200-second dispute window was not long enough to catch it. Arbitrum co-founder Steven Goldfeder was quick to note that Arbitrum’s own native bridge “has not been hacked or exploited in any way,” and he was right: the flaw lived in a bridge layer built on top. Coreum this month is the twist on the theme. Its bridge demanded a robust 17 of 28 relayer signatures, and it still failed, because the signers were faithfully approving withdrawals against deposits the software had recorded but never actually received. A high quorum is worthless if the thing every honest signer is verifying is a lie.

Failure Mode Two: When the Bridge Believes a Lie

This is the most instructive failure mode, because the contract does everything right. It executes flawlessly on false input. Wormhole is the canonical case. In February 2022 an attacker exploited a deprecated Solana verification function that failed to confirm a signature account genuinely belonged to Wormhole’s guardian network, forged a validation message, and minted 120,000 wrapped ETH worth about $325 million out of nothing. The guardians never voted. The bridge just accepted a message that looked like their approval.

KelpDAO in April 2026 was the same disease at a larger scale, and it is the case that best captures where the industry actually stands. The rsETH bridge, moving a liquid restaking token of the sort now drawing serious institutional liquid staking money, was configured so that a single verifier was sufficient to approve a cross-chain message. Attackers compromised internal RPC infrastructure feeding that verifier while flooding external providers with denial-of-service traffic, then spoofed a message and drained about $292 million. There was no Solidity bug to patch. Ben Fisch, chief executive of Espresso Systems, gave the sharpest one-line diagnosis in that CoinDesk report: “The bridge worked as designed. It just believed the wrong information.” His broader point cuts to the whole category: “Most bridges don’t fully verify what happened on another chain. Instead, they rely on a smaller system to report it.”

Sergej Kunz, co-founder of 1inch, added the cultural half of the explanation in the same piece: “Security is often not the top priority. Teams focus on launching quickly.” He also named the mechanism that turns a bridge hack into a market-wide event: once a bridged asset is accepted as legitimate collateral somewhere else, a fake mint becomes real leverage, and “that’s how contagion happens.” Coreum belongs in this bucket too, alongside the multisig one, because its ultimate failure was epistemic: the system was tricked into believing a deposit that never landed. The signers were honest, the code ran as written, and the money still left.

Failure Mode Three: When the Code (or the Operator) Really Is the Problem

Pure code bugs do happen, and they can be spectacular; they are just the minority of the losses. Nomad in August 2022 is the definitive example. A routine upgrade initialized a “trusted root” to a blank value that happened to match the default for unproven messages, so every message auto-validated. What followed was not a single hacker but a crowd: hundreds of unrelated wallets copied the first exploit transaction, swapped in their own addresses, and helped themselves. Google’s Mandiant later called it a case of “decentralized robbery,” with about $190 million gone and only some $36 million later returned under a bounty.

Poly Network in 2021 was a logic-and-permissions failure: a privileged contract had call rights that let the attacker register their own key as a keeper and authorize withdrawals of more than $610 million, which was then returned almost in full after the team publicly addressed the attacker as “Mr. White Hat.” The BNB Bridge in October 2022 saw a forged Merkle proof mint two million BNB, but BNB Chain’s small validator set halted the entire network within hours, freezing most of the loot; SlowMist later estimated only a fraction actually escaped, per Halborn’s post-mortem. The irony is exact: the same centralization that made the chain a target is what let it respond fast enough to contain the damage.

Then there is the failure mode that no audit can price: the operator who disappears. Multichain was never a clean code exploit. Its chief executive was detained by Chinese police in mid-2023, taking with him the MPC infrastructure he alone controlled; roughly $130 million then moved to unknown addresses, the protocol shut down, and years later the liquidation is still grinding through the courts. A bridge that depends on one person’s uptime was always one arrest away from death. That is a custody problem wearing a smart-contract costume.

The Repeat Offenders: Post-Mortems Nobody Applied

If there is one finding in the 2026 data that should embarrass the industry, it is this: some bridges got hacked the exact same way twice. Allbridge lost about $1.65 million in July when an attacker used a roughly $1.12 million flash loan, the same primitive that powers much of the invisible MEV economy, to skew a Solana pool’s USDC/USDT ratio and bleed the bridge. The uncomfortable part is that this was Allbridge’s second near-identical hit. Back in April 2023, its BNB Chain pools were drained the very same way, after which the team published a fix, one liquidity pool per chain, that structurally blocks same-transaction manipulation. The fix was never extended to the Solana deployment, which kept running the side-by-side pools the 2023 post-mortem said it had eliminated.

VerusCoin’s Ethereum bridge went further, getting hit twice in nine weeks. It was first drained in May for more than $11 million after an attacker bypassed a safety check, most of which was later returned in a white-hat deal. Then on July 23 it was drained again for about $7.54 million through the same class of vulnerability, this time by a different attacker who laundered the proceeds and left the team issuing no public statement at all. Post-mortems have become a genre in crypto, complete with house style and a comforting arc of accountability. These cases are the reminder that writing one is not the same as shipping the fix everywhere it is needed. An unapplied lesson is just a paper trail for the next attacker.

The 2026 Wave, Case by Case

The summer of 2026 delivered a bridge exploit roughly every few days, and taken together the wave is a near-perfect confirmation of the keys-and-verification thesis. Taiko lost about $1.7 million in June after an SGX signing key was accidentally exposed on GitHub, used to forge withdrawal proofs; the team patched, refilled reserves one-to-one, and reopened in ten days, telling users “every user is whole,” and its token jumped 136% on the recovery. Wanchain’s Cardano bridge lost roughly $10 million in NIGHT tokens to a signature-encoding flaw in July; seven major exchanges froze the attacker’s accounts, and the team set an August 6 deadline for a keep-10%, return-90% bounty that lapsed without any public confirmation that the funds came back. B2 Network lost about $3.86 million when a staking-contract upgrade authority was misused, not a code bug but a stolen administrative key.

Charles Hoskinson, the Cardano and Input Output founder, used the Wanchain hack to make a broader argument that the whole attack surface has shifted. “All software is under this enormous assault” from automated and AI-assisted vulnerability discovery, he told CoinDesk, comparing a bridge that is merely 90% hardened to being “90% resistant to a deadly disease. If you’re exposed to it enough, eventually you still catch the disease.” His prescription, unsurprisingly, is to replace trust in operators and multisigs with zero-knowledge proofs. Whether or not you buy the sales pitch, the diagnosis matches the data: the cheapest way to attack a bridge in 2026 is not to find a clever bug in the contract but to find the humans, the servers, and the keys around it.

Who Actually Pays: The Economics of Recovery

Return to that stubborn last column from Table 1. Whether users get repaid after a bridge hack has almost nothing to do with the elegance of the exploit and almost everything to do with the balance sheet standing behind the bridge. There are, in practice, four archetypes, and it is worth being blunt about which one you are relying on before you send funds anywhere.

The deep-pocket backstop is the fastest and the rarest. Jump Crypto replaced Wormhole’s entire 120,000 ETH within roughly a day, and Sky Mavis raised a $150 million round led by Binance and covered the rest of Ronin from its own treasury. Both were discretionary acts by well-funded firms, not obligations. The white-hat bounty is the workhorse: Poly Network’s near-total return, Nomad’s partial clawback, and Taiko’s rapid refill all ran through some version of “keep a slice, give back the rest,” the same negotiated market that HOGE Wire has covered under the heading of bug bounties in 2026.

The freshest and most interesting model is the coalition rebuild. After KelpDAO, a group of DeFi protocols including Aave and Mantle, operating as a “DeFi United” effort, rebuilt the rsETH backing over about five weeks in two tranches, with accrued staking rewards paid through and no losses passed to end users. It is a genuinely new answer to an old problem, a bailout financed by the ecosystem rather than a single sponsor. And then there is the fourth archetype, the one nobody advertises: nothing. Harmony’s users and most of Multichain’s were never made whole. The honest takeaway for anyone bridging assets is that your safety net is not the audit report. It is the question of who, if anyone, would choose to write a very large check on your behalf at 3 a.m.

Follow the Money: How Bridge Loot Gets Laundered

Stealing the money is only half the operation; moving it is the other half, and here the tooling has shifted in a way that matters for defenders. For years the default was Tornado Cash, the Ethereum mixer that absorbed proceeds from Ronin, Harmony, and Nomad among others. After sanctions and enforcement scrambled that route, sophisticated attackers moved to cross-chain swap services and privacy assets. The B2 Network thief is the textbook 2026 example: the stolen tokens were swapped into BNB, bridged to Ethereum, and then routed toward Zcash through NEAR Intents, a laundering path designed specifically to defeat any tool that can only follow one chain at a time.

The irony is that bridges are now both the target and the getaway car. The same cross-chain hops that make bridges hard to secure make stolen funds hard to trace, because each hop hands the money to a new ledger with a new set of watchers. Investigators increasingly describe cross-chain laundering as the primary challenge in the field, not because any single service is unbreakable but because the number of hops multiplies the work. It is a reminder that the security question does not end at the exploit. A bridge failure is a supply chain, from the compromised key to the mixer to the exchange that either freezes the wallet or doesn’t, and the industry’s ability to claw funds back depends on every link.

The Regulator’s Dilemma

Bridge hacks put regulators in an awkward position, and the Tornado Cash saga is the clearest illustration. In August 2022 the U.S. Treasury’s Office of Foreign Assets Control sanctioned Tornado Cash, citing more than $7 billion laundered through it, with funds from Ronin, Harmony, and Nomad named specifically. It was a direct response to bridge theft. Then the ground shifted: in late 2024 the Fifth Circuit ruled that OFAC had exceeded its authority, on the logic that immutable smart contracts nobody controls after deployment are not “property” of a sanctionable person, and in March 2025 Treasury delisted Tornado Cash, removing more than a hundred addresses from the sanctions list.

The dilemma is almost poetic. The very property that makes a bridge hard to secure, code that runs with no operator once it is deployed, is what makes it hard to sanction after the fact. Criminal enforcement against individuals has held up far better than sanctions against protocols; a key suspect in the Nomad exploit was extradited to the United States, a person who can be arrested, unlike a contract that cannot. For the Securities and Exchange Commission and the Commodity Futures Trading Commission, the harder questions are about the wrapped assets bridges create and how responsibility attaches when a thinly-backed token blows up across a dozen venues. That is the frontier where compliance meets code, a subject HOGE Wire has explored in how the rules get into the code. The blunt regulatory lesson from five years of bridge hacks is that you can prosecute a person and you can pressure an exchange, but you cannot subpoena a smart contract.

The Market Votes With Its Feet

While regulators debated, capital moved, and it moved fast. The KelpDAO exploit turned a single-verifier configuration into an object lesson, and within weeks roughly $4 billion in bridged assets migrated from LayerZero to Chainlink’s CCIP. The exodus kept compounding. In early August, BitGo made CCIP the sole cross-chain provider for more than $7 billion of Wrapped Bitcoin, pushing the announced LayerZero-to-Chainlink tally close to $15 billion, with Mantle, Lombard, Aave, Kraken, Solv, Virtuals, and Re all having made the same move. This is the market repricing bridge risk in real time, treating the choice of verification layer as a first-order security decision rather than a plumbing detail.

The technical argument behind the migration is the one this whole analysis has been building toward: reduce the number of things you have to blindly trust. Chainlink co-founder Sergey Nazarov frames CCIP’s design as “defense in depth, not blind trust,” with an independent Risk Management Network watching each lane on top of a large set of node operators, rather than a single configurable verifier. LayerZero, for its part, raised its minimum verifier requirements after KelpDAO so that a one-of-one setup can no longer secure a production deployment, pushing users toward multi-verifier configurations. Whatever your view of any single vendor, the direction is unmistakable: single points of trust are being engineered out, because five years of hacks have proved that a single point of trust is a single point of theft.

What Actually Makes a Bridge Safer

Pulling the analysis together, the interventions that actually move the needle are not the ones the headlines fixate on. Five stand out. First, eliminate single points of trust: multiple independent verifiers, larger and more decentralized validator sets, and keys held in hardware isolation so that phishing one engineer cannot open the vault. Second, verify rather than attest wherever possible; light clients and zero-knowledge validity proofs move a bridge from believing a committee to checking the source chain’s own math, which is the ceiling Buterin described and the direction Hoskinson is betting on. Third, mint fewer wrappers: liquidity-network designs and native issuance, such as burn-and-mint models, shrink the honeypot because there is no giant pool of collateral to steal in the first place.

Fourth, build in rate limits and circuit breakers. The BNB Bridge kept most of its loot precisely because the chain could halt; a bridge that can pause itself the moment an anomalous flow appears turns a total loss into a contained one. Fifth, and most under-appreciated, treat operational security as a first-class engineering discipline rather than an afterthought, because that is where the overwhelming majority of 2026’s losses actually came from. The honest conclusion is not that bridges will stop being attacked. They won’t; they hold too much money in too concentrated a place. The realistic goal is to make the blast radius survivable and the recovery fast. The best outcomes of 2026, Taiko reopening in ten days and KelpDAO’s coalition rebuild, were victories of response, not prevention. In a world where every bridge is a target, resilience is the security model that is left.

Frequently Asked Questions

Why do crypto bridges get hacked so often?

Because they concentrate value and rely on trusting claims about another blockchain. A bridge holds the collateral behind every wrapped token it issues, and it must decide whether a transfer really happened on a chain it cannot natively read. Most failures come from stolen keys, spoofed verification, or operational mistakes rather than from bugs in the smart-contract code itself.

What was the biggest bridge hack ever?

The Ronin bridge behind Axie Infinity, drained of about $625 million in March 2022 when attackers obtained five of its nine validator keys. It remains the largest single crypto theft on record, and users were repaid only because Sky Mavis raised fresh capital and covered the rest from its balance sheet.

Are bridge hacks usually caused by bad code?

Usually not. TRM Labs found that in the first half of 2026, infrastructure and operational compromises, meaning stolen keys and hijacked servers, were only about 15% of incidents but roughly 76% of the money lost. Smart-contract bugs were far more common but far less costly.

Do users get their money back after a bridge hack?

It depends entirely on who stands behind the bridge. Well-capitalized backers have replaced stolen funds within days (Wormhole, Ronin), white-hat bounties have coaxed partial or full returns (Poly Network, Nomad, Taiko), and peer protocols have rebuilt the shortfall as a coalition (KelpDAO). When no one backstops the bridge, as with Harmony and Multichain, the losses stick.

How can I reduce my risk when using a bridge?

Prefer bridges secured by many independent verifiers or large validator sets rather than a single signer, favor systems that issue assets natively over ones that mint thinly-backed wrappers, and check for published audits, rate limits, and circuit breakers. Above all, treat bridged wrappers as somewhere to pass through, not somewhere to park a large balance.

By Daniel Voss, security desk, HOGE Wire.