Bridge Security in 2026: Crypto’s Biggest Honeypot, Explained

Every blockchain is an island. Bitcoin cannot see Ethereum, Ethereum cannot see Solana, and an asset minted on one chain has no native way to exist on another. Cross-chain bridges are the plumbing that papers over that isolation, and to do it they hold enormous pools of locked value. That combination, young software sitting on top of a very large pile of other people’s money, is exactly why bridges became the single richest target in crypto.

The numbers are brutal. In 2022, blockchain analytics firm Chainalysis counted roughly $2 billion stolen across 13 separate bridge hacks, which accounted for 69% of all crypto stolen that year. Roughly half of it was traced to North Korea. For a stretch of 2022, breaking a bridge was the most lucrative activity in the entire industry.

The good news is that it got better. Security firm Immunefi reported that bridge exploits fell from 73% of DeFi losses in 2022 to about 3% in 2025, as teams moved to stronger verification and decentralized validator designs, with overall DeFi exploit losses down roughly 74% from the 2022 peak. The risk did not vanish, though. It moved. This guide explains what a bridge actually does, how the money moves, why bridges break, who steals from them, and how to read a bridge’s security before you trust it with a dollar.

What a cross-chain bridge actually does

Start with the thing a bridge cannot do: it cannot physically send a coin from one chain to another. There is no wire that carries an Ether token from Ethereum to Arbitrum. What a bridge does instead is coordinate two actions on two separate ledgers so that, from the user’s point of view, value appears to have moved. You lock or burn an asset on the source chain, and the bridge mints or releases a matching asset on the destination chain.

The hard part is proving the match. Something has to convince the destination chain that the lock or burn really happened on the source chain, and that it has not already been claimed. That something is the bridge’s verification layer, usually a set of off-chain actors who watch the source chain and attest to events. Whoever or whatever controls that attestation controls the money. Every serious bridge hack in history is, at bottom, a story about that attestation being faked, bypassed, or stolen.

Bridges come in two flavors by purpose. Asset bridges move tokens. General message-passing bridges move arbitrary data, so a contract on one chain can call a contract on another; token transfers are then just one application built on top. The security questions are the same for both: who attests, and what happens if they lie. That second question is the one most users never ask, and it is the one that decides whether a bridge is a convenience or a trap.

Why bridges became crypto’s biggest honeypot

Bank robber Willie Sutton supposedly explained his career choice by saying he went where the money was. Bridges are where the money is. A bridge that connects twenty chains has to hold collateral for every asset it supports on every route, so its contracts routinely custody hundreds of millions of dollars in a handful of addresses. Drain those addresses and you take the whole pool at once, with no need to pick off users one by one.

Three things make that pool unusually easy to attack. Bridge code is young and complex, stitching together assumptions about multiple chains that each evolve on their own schedule. The value at risk is concentrated, so one bug pays for itself many times over. And the trust model is often weaker than users assume, with a small multisig or a short list of validators standing between the attacker and the vault. Stack those together and you get the defining statistic of 2022: most of the money stolen in crypto that year came out of bridges, not exchanges or lending protocols.

The identity of the thieves matters here. Chainalysis estimated North Korean-linked hackers took around $1 billion in 2022, almost entirely from bridges and other DeFi protocols. For a sanctioned state cut off from the banking system, a bridge is not just a honeypot; it is a cash machine, and one that funds weapons programs rather than a lone hacker’s retirement. That reframes bridge security as a matter of national security, a point regulators would soon make in public.

There is a second-order problem that makes the honeypot worse: composability. A wrapped asset does not just sit in a wallet after it crosses a bridge; it gets deposited into lending markets, posted as collateral, and paired in liquidity pools across the destination chain. When a bridge is drained and its wrapped token collapses toward zero, every protocol holding that token takes the hit at once, so a single bridge failure can cascade into lending platforms and exchanges that never touched the bridge themselves. The pool is large, and the blast radius is larger.

The trust spectrum, from custodial to trustless

Bridges are usually sorted by how they verify that source-chain event, and the spectrum runs from fully trusted to fully trustless. At the trusted end, a bridge relies on external actors: a company, a multisig of named signers, or a federation running multi-party computation (MPC). You trust that those signers are honest and that their keys are safe. These bridges are fast and cheap to build, which is why most early bridges were trusted, and why most early bridge hacks were key compromises.

At the trustless end, the destination chain verifies the source chain’s consensus directly, with no human in the loop. A light-client bridge runs a lightweight version of the source chain’s validation inside a smart contract on the destination; a zero-knowledge bridge compresses that proof into a succinct cryptographic statement. These are far harder to attack because there is no validator set to bribe or phish, but they are expensive, slow to build, and specific to each pair of chains they connect.

In between sit optimistic bridges, which assume a message is valid unless someone submits a fraud proof during a challenge window, and liquidity networks, which avoid global trust entirely by keeping real pools of assets on both sides and simply paying you out of the destination pool. Atomic swaps sit at the far trust-minimized corner but only work for simple peer-to-peer trades. There is no free lunch: each design trades speed, cost, and generality against how much you have to trust someone you cannot see.

How the money moves: lock-and-mint, burn-and-mint, and liquidity

Under the hood, almost every bridge uses one of three settlement patterns, and the pattern largely determines where the risk sits.

• Lock-and-mint. The source chain locks your real asset in a contract and the destination chain mints a wrapped IOU that represents it. To come back, you burn the wrapped token and the original is unlocked. The locked pool is the honeypot; the wrapped assets drained from Ronin and Harmony lived on this model.
• Burn-and-mint. The asset itself is burned on the source chain and an equal amount of the same canonical asset is minted on the destination. There is no permanent locked pool for that asset, so there is nothing to drain. This is how Circle’s native USDC transfers work.
• Liquidity networks. Pools of real assets sit on both chains. You deposit on the source side and a liquidity provider pays you out on the destination side, taking a fee and absorbing the timing risk. The user is exposed to slippage and provider solvency rather than to a wrapped IOU.

Keep this distinction in mind for the rest of this article. The hacks that defined the category almost all hit lock-and-mint designs, because that is where the largest standing pools of value sat waiting. The industry’s most important security trend of the past two years has been a quiet migration away from that model wherever it can be avoided.

Anatomy of the biggest bridge hacks

Seven incidents between 2021 and 2023 account for most of the money ever stolen from bridges, and together they map the entire attack surface. The table below lays them out; the sections after it group them by what actually failed.

Two buckets cover all of them. Either the keys that authorize withdrawals were stolen, or the code that verifies cross-chain messages was tricked into approving a withdrawal that never had a matching deposit. The next two sections take each in turn, because the defense against each is completely different.

One pattern in that table is easy to miss and dangerous to rely on. In most of the cases where users were made whole, a deep-pocketed or centralized party stepped in: Jump Crypto covered the Wormhole shortfall, Binance halted an entire chain to freeze the BNB loot, and Poly Network’s attacker simply chose to give the money back. Those are not guarantees; they are good luck and deep balance sheets. A smaller bridge with no billion-dollar backer and no power to pause the chain offers no such safety net, which is why the trust model matters far more than the brand name on the front end.

Private key compromise, the number one killer

The most expensive bridge failures were not clever smart-contract exploits. They were stolen keys. The Ronin bridge behind the game Axie Infinity used a validator set of nine, and a withdrawal needed five signatures. Attackers gained control of five keys, four belonging to operator Sky Mavis and one from a third-party validator run by the Axie DAO, and then quietly drained about 173,600 ETH and 25.5 million USDC. The theft, later attributed by the US Treasury to North Korea’s Lazarus Group, went unnoticed for six days, until a user could not withdraw.

The intrusion reportedly started the way many state-sponsored attacks do, with social engineering rather than code. A Sky Mavis employee was targeted through a fake recruiting approach, the same playbook HOGE Wire has documented in fake interviews and deepfake recruiter calls and in the broader crypto phishing kill chain. Once an attacker is inside the operator’s systems, a five-of-nine threshold is worth very little if those keys sit on the same infrastructure, which they did.

Harmony’s Horizon bridge told the same story in miniature: it secured a huge pool with a two-of-five multisig, and the FBI later confirmed Lazarus Group compromised enough keys to move roughly $100 million. Multichain was worse still: investigators found its chief executive personally controlled all of the MPC signing keys on his own cloud servers, so when Chinese police arrested him, around $130 million drained out and the protocol collapsed. The cryptography held in every case. The humans and their key management did not. The lesson is that a signature threshold is only as strong as the independence of the people and machines behind each signature.

When the code lies: verification and message-passing bugs

The other bucket is subtler and, to a security engineer, more interesting. Here the keys are safe, but the contract that checks cross-chain messages can be fooled into treating a forgery as genuine. Wormhole, a message-passing bridge between Solana and Ethereum, lost about $320 million in February 2022 when an attacker exploited a flaw in its signature verification to mint 120,000 wrapped ETH that was never deposited. Its backer, Jump Crypto, replaced the funds within days to keep the wrapped token solvent, a bailout no ordinary project could have afforded.

Nomad produced the most chaotic incident in the genre. A routine upgrade initialized a trusted root to zero, which had the side effect of making every message prove as valid. Once the first looter’s transaction was public, anyone could copy it, swap in their own address, and withdraw; hundreds of wallets piled in and about $190 million left the contract over a few hours in what observers called the first crowd-sourced hack. It was a single misconfigured value, not an exotic exploit.

Binance’s BSC Token Hub was broken the same year when an attacker forged a Merkle proof and minted two million BNB out of thin air. Then Binance chief executive Changpeng Zhao posted that “an exploit on a cross-chain bridge, BSC Token Hub, resulted in extra BNB,” and said validators had been asked to temporarily suspend the chain, a drastic step that froze most of the loot but exposed how centralized the network really was. The earliest of these, Poly Network in 2021, was similar in spirit: the attacker exploited a cross-chain relay design to change the contract’s keeper and authorize their own withdrawals, before a hacker the team awkwardly nicknamed Mr White Hat returned almost all of the roughly $611 million.

Multi-chain, not cross-chain: Vitalik Buterin’s warning

Weeks before the 2022 wave began, Ethereum co-founder Vitalik Buterin argued that the problem was not just sloppy implementations but a structural ceiling. In a January 2022 post he wrote that “the future will be multi-chain, but it will not be cross-chain,” citing fundamental limits to the security of bridges that hop across multiple zones of sovereignty.

His argument is worth understanding because it still holds. When you hold a native asset on its home chain, you inherit that chain’s full security. The moment that asset is locked on chain A and represented on chain B, its safety depends on both chains and on the bridge between them. If chain A suffers a deep reorganization or a 51% attack, an attacker can, in effect, spend the same deposit twice and leave the bridge insolvent. Worse, Buterin noted, the risk compounds: the more assets and the more chains that route through bridges, the larger the systemic damage a single failure can cause. A trustless bridge narrows this gap but cannot close it, because a bridged asset can never be safer than the weakest system it passes through. Four years on, this is the honest frame for everything that follows: modern designs lower the odds of a failure, they do not repeal the ceiling.

How modern bridges try to be safer

The industry’s response to 2022 was to push verification away from small trusted groups and toward either larger, more independent validator sets or outright cryptographic proof. The table summarizes the main models you will encounter today.

In practice the leading message layers now blend these ideas. LayerZero’s second version lets each application assemble its own security stack from independent decentralized verifier networks, so a project can require several unrelated parties to agree before a message lands. Wormhole rebuilt around a fixed, named set of validators called Guardians after its hack. Chainlink’s CCIP adds a separate risk-management network, written by a different team in a different language, whose only job is to watch for anomalies and halt suspicious transfers. Zero-knowledge light clients, the long-promised endgame, are finally reaching production for some chain pairs, replacing trusted signers with math. None of this makes a bridge unhackable, but defense in depth is why, as Immunefi’s data shows, the bleed has slowed so sharply since 2022.

The catch is that flexibility reintroduces human error. A framework that lets an application choose its own verifier set also lets a careless team choose a weak one, collapsing a nominally decentralized design back down to a single signer. Shared dependencies are another soft spot: when dozens of bridges and rollups lean on the same messaging layer or the same oracle, a bug there is a bug everywhere at once. And audits, while essential, mostly catch coding mistakes rather than flawed economic assumptions or misconfigurations, which is why several losses after 2022 came from logic that was technically working as written. Decentralized verification raises the floor; it does not remove the need to read the fine print.

Native issuance and the canonical-token turn

The most effective fix for the honeypot problem is to remove the honeypot. If a token is burned on the source chain and an identical, fully native token is minted on the destination, there is no permanent locked pool backing a wrapped IOU, and therefore nothing for an attacker to drain. This is the model behind Circle’s Cross-Chain Transfer Protocol, which burns USDC on one chain and mints native USDC on another against a Circle attestation, preserving a single canonical supply. Circle’s second-generation CCTP, launched in 2025, cut settlement from the roughly fifteen to nineteen minutes of Ethereum finality to a matter of seconds and added hooks that let the destination contract act the instant the mint lands.

Issuers of other major assets have followed, and native-token-transfer frameworks now let projects keep one canonical token and bridge it by burning and minting rather than wrapping. The trade-off is honest rather than free. You no longer trust a bridge’s validator set, but you do trust the issuer: Circle can freeze USDC, and a native-token framework concentrates control with whoever can mint. For a regulated stablecoin that is often an acceptable swap, since the issuer already holds that power. For a decentralized asset that wants to avoid a central point of control, handing one party the mint key is its own risk, and the choice should be made deliberately rather than by default.

The same logic has reshaped how assets reach layer-2 networks. A rollup’s own canonical bridge inherits the security of its proof system and settles back to Ethereum, which is why moving funds through the official bridge is almost always safer than a faster third-party route that relies on its own validators. The convenience bridges still have a place when speed matters, but the canonical path is the one that does not stack a new trust assumption on top of the chain you are already using. When the destination is an L2, the safest bridge is usually the boring one the chain ships with.

Intents, chain abstraction, and hiding the bridge

The newest wave of design tries to make bridging invisible. Intent-based systems let you state an outcome, such as having a certain amount of USDC show up on Base, and leave the how to a competitive market of solvers. A solver fronts you the funds on the destination chain almost immediately and then reclaims them from the slower settlement layer afterward, absorbing the finality risk in exchange for a fee. From your seat the transfer feels instant and the bridge disappears, which is also the aim of the emerging ERC-7683 standard for expressing cross-chain intents.

Chain abstraction goes further, with wallets that hide which chain you are on entirely and route value behind the scenes. This is a genuine usability leap, and increasingly it pairs with smart-account wallets that can enforce spending policies and session limits. But security engineers warn that abstraction hides risk without removing it. Under the clean interface, a solver or a messaging layer is still making a trust assumption on your behalf, and if that layer is compromised the loss is just as real as it was for a 2022 bridge user. The lesson of the hack era applies to the intent era: always ask who is actually attesting that your money moved.

Intents also create their own failure modes. The solver market can centralize around a few well-capitalized firms, which reintroduces censorship and front-running concerns familiar from MEV, and a solver that misprices or mishandles settlement risk can go insolvent and stall withdrawals. These are gentler failures than a drained pool, since the user is usually fronted real assets rather than a wrapped IOU, but they are failures all the same. The point is not that intents are unsafe; it is that convenience has relocated the trust, not deleted it.

How to read a bridge’s security before you use it

You do not need to audit Solidity to judge a bridge. A handful of questions, borrowed from the way public risk trackers such as L2BEAT frame cross-chain systems, separate the defensible from the dangerous.

The bug-bounty question deserves its own line. Serious bridges now run large public bounties, often in the millions of dollars, precisely because paying a researcher is far cheaper than losing the pool; a protocol that caps its top payout at a few thousand dollars is telling you how it values your deposit. Two rules of thumb then cover most people. Prefer a chain’s official or canonical bridge over a third-party one for moving assets onto that chain, because the canonical bridge usually has the strongest verification and the most scrutiny. And treat any bridge that cannot clearly explain its trust model as a bridge you do not understand, which means you cannot price its risk.

The state-sponsored thief meets the regulator

Bridge security is not only an engineering story; it is a national-security one. North Korea’s Lazarus Group turned bridge theft into state revenue, and US authorities responded with the tools they had. The Treasury’s Office of Foreign Assets Control sanctioned wallet addresses tied to the Ronin theft and, controversially, the Tornado Cash mixer used to launder proceeds, while the FBI publicly pinned the Harmony hack on the same group. Chainalysis has tracked partial seizures of the Ronin funds as investigators followed the money across chains.

For American users the Securities and Exchange Commission adds a second layer of uncertainty. Wrapped and bridged tokens, and the governance tokens that many bridges issue, sit in a gray zone the SEC has at times treated as potential securities, which shapes how US platforms list them and how projects structure their tokens. The practical takeaway is that a bridge’s risk is not only technical. A protocol can be solid code and still expose you to frozen funds if it is caught up in a sanctions action or an enforcement sweep, so where a bridge is based and how it handles compliance belong on the checklist alongside its cryptography.

This is not abstract for ordinary users. When OFAC sanctions an address, compliant front-ends and exchanges begin screening against it, so funds that merely passed through a tainted bridge or mixer can be flagged and frozen when you try to cash out, even if you did nothing wrong. The Tornado Cash designation was later contested in court, a reminder that the rules themselves are still being written. The safe assumption is that regulatory risk travels with cross-chain funds just as surely as technical risk does, and that a clean on-ramp at the far end is part of what you are paying for.

What this means for you

For a normal user, the goal is not to avoid bridges, which are unavoidable in a multi-chain world, but to limit your exposure to any one of them. Move value when you need to, not as a place to park it, and keep bridged positions small and short-lived. The longer your assets sit as a wrapped IOU, the longer you are betting on someone else’s key management.

• Prefer native issuance such as CCTP for stablecoins, and a chain’s official bridge for everything else.
• Split large transfers into smaller ones rather than routing your whole stack through one contract in one go.
• Revoke the token approvals a bridge asked for once you are done, so a later exploit cannot reach back into your wallet.
• Keep the assets you are not actively bridging in cold storage; our comparison of Ledger, Trezor and Tangem covers the hardware options.
• Before a first-time transfer, test the route with a small amount and confirm it arrives before sending the rest.

For a deeper, step-by-step version of this, including which bridges and aggregators suit specific routes, see our risk playbook for bridging crypto safely. The through-line is simple: a bridge is only ever as safe as its weakest attestation, so treat every one as a short-term tool, never a vault.

Frequently Asked Questions

Are crypto bridges safe in 2026?

Safer than they were, but not safe. Immunefi data shows bridge exploits fell from 73% of DeFi losses in 2022 to about 3% in 2025, helped by stronger verification and decentralized validator designs. The risk did not disappear, though; it moved toward messaging layers, misconfigured verifiers, and the wallets of the people who use bridges.

What was the biggest crypto bridge hack?

By dollar value at the time, the two largest were Poly Network in August 2021 (around $611 million, almost all returned by a hacker the team called Mr White Hat) and the Ronin bridge in March 2022 (around $620 million, attributed by the US Treasury to North Korea’s Lazarus Group).

Why do crypto bridges get hacked so often?

Because they pool huge amounts of value behind a small set of trust assumptions. Most losses trace to two causes: private keys being stolen or misused, as at Ronin, Harmony and Multichain, and bugs in how the bridge verifies cross-chain messages, as at Wormhole, Nomad and BNB Token Hub. Either failure lets an attacker mint or release assets that were never really deposited.

What is the safest way to move stablecoins across chains?

For USDC, Circle’s Cross-Chain Transfer Protocol burns the coin on the source chain and mints native USDC on the destination, so there is no large wrapped pool to drain. Official or canonical bridges run by a chain’s own team are generally safer than third-party bridges, and native issuance avoids the wrapped-IOU model that caused the worst hacks.

What does multi-chain, not cross-chain mean?

It is Vitalik Buterin’s argument that a world of many blockchains is fine, but moving assets between them with bridges has a hard security ceiling. A bridged asset is only as safe as the weakest chain and verifier it touches, and a 51% attack on one chain can put funds held on another at risk.

By the HOGE Wire DeFi desk, reporting on on-chain security, bridges and cross-chain infrastructure.