Bridge Security in 2026: Inside Crypto’s Richest Honeypot

Move money from one blockchain to another and you almost never move the asset itself. You lock the real coins in a contract on the chain you are leaving, and a bridge issues a claim on the chain you are entering. That claim is only as good as the promise that the locked collateral is safe and that the people or code authorizing the mint are honest. For most of crypto’s short history, that promise has been the single most expensive thing to keep.

The numbers are blunt. Blockchain analytics firm Chainalysis estimated that roughly $2 billion was stolen from cross-chain bridges across 13 separate incidents in 2022, about 69 percent of all crypto stolen that year up to that point. Bridges did not get hacked because builders were careless. They got hacked because they are structurally the richest, most concentrated target in the entire industry, and because the shortcut most of them took on verification was exactly the shortcut attackers knew how to break. This is a guide to how bridges work, why they fail, what the worst failures taught the industry, and how to tell a durable bridge from a trap.

Why bridges exist, and why they became crypto’s biggest honeypot

There is no single blockchain. There is Bitcoin, Ethereum, a dozen large alternative layer ones, and dozens of layer two rollups built on top of Ethereum. Each is its own closed world with its own ledger, and none of them can natively read another’s state. A coin that lives on Ethereum does not exist on Solana, and no amount of wishing makes it appear there. If you want value to move between these worlds, something has to sit in the middle and keep the two sides consistent. That something is a bridge.

The simplest bridge takes custody of the real asset on the origin chain and mints a stand-in on the destination chain. Deposit one Ether on the Ethereum side, and the bridge locks it in a vault contract and issues one wrapped Ether on the other side. Burn the wrapped version later and the bridge releases the original. The wrapped token trades, lends, and farms exactly as if it were the real thing, because everyone agrees it is redeemable one for one. That agreement is the whole game.

The problem is what accumulates in the vault. Every deposit adds to a single pot of genuine, liquid, immediately sellable assets, all guarded by one set of contracts and, usually, one set of keys. Chainalysis put it plainly: bridges are attractive because they feature a central storage point of funds that back the bridged assets on the receiving chain. A protocol holding hundreds of millions of dollars behind a thin trust assumption is not a bug in the design, it is the design. Attackers simply read the balance and worked out the cheapest way to lie to the thing guarding it.

What a bridge actually does: lock, mint, burn, release

Underneath the marketing, almost every bridge is one of a few mechanical patterns. The most common is lock-and-mint. Assets are locked on the source chain and an equal amount of wrapped representations are minted on the destination. To go back, the wrapped tokens are burned and the originals are released, which is the burn-and-release half of the same loop. The entire security of this model rests on one question: who is allowed to tell the destination chain that a deposit really happened, and what stops them from saying it when it did not.

A second pattern avoids minting entirely. A liquidity-network bridge keeps pools of the same asset on both chains. When you want to move USDC from chain A to chain B, you hand your USDC to the pool on A and a solver or liquidity provider pays you out of the pool on B, rebalancing later. Nothing is wrapped; you are swapping into pre-positioned inventory. This trades one risk for another. You are no longer exposed to a minting authority, but you are exposed to the solvency of the pools and to whatever messaging layer tells the two sides they are square.

A third pattern is pure messaging. Generic cross-chain messaging layers do not themselves hold your coins; they carry arbitrary data, and applications build token bridges on top. That is more flexible and, in some designs, more dangerous, because a single messaging bug can compromise every application that trusted it. Whatever the shape, the bridge’s job reduces to attesting that an event on one chain is true to a second chain that cannot see the first. Everything that has ever gone wrong with a bridge is a failure of that attestation.

The core problem: a bridge is only as strong as its weakest verifier

Strip a bridge down and you find a verifier: a mechanism that answers “did deposit X really happen on chain A?” and, if the answer is yes, authorizes a mint or a release on chain B. The security of the whole system is the security of that one answer. If an attacker can make the verifier say yes to a deposit that never happened, the vault empties. Every design choice in the bridge world is ultimately a choice about who or what gets to give that answer and how expensive it is to make them lie.

There are two honest ways to do it and a lot of shortcuts. The honest ways are to have the destination chain verify the source chain’s own consensus using cryptography (a light client), or to produce a succinct cryptographic proof that the event happened (a zero-knowledge proof). The shortcut, taken by most early bridges, is to appoint a committee of outside validators and have them vote. The committee is fast, cheap, and flexible. It is also a set of private keys sitting on servers, and private keys get stolen.

This is the same structural weakness that plagues price oracles, where a protocol imports an external truth and an attacker games the mechanism that vouches for it. When the thing that certifies reality can be bought, borrowed, or forged for less than the value it guards, the exploit is not really a hack in the Hollywood sense; it is a legitimate transaction inside a broken rulebook, the kind of problem we unpacked in our look at oracle extractable value and the exploits DeFi made legal. A bridge is an oracle for “a deposit occurred,” and the economics are identical.

The interoperability trilemma, and the three ways to verify

Arjun Bhuptani, co-founder of the interoperability protocol Connext, framed the design space as an interoperability trilemma. A bridge wants to be trustless (secured by the connected chains rather than by outsiders), extensible (able to support any chain), and generalizable (able to pass any kind of data, not just token transfers). In practice you get to pick two. Push hard on trustlessness and extensibility and you lose generality; chase generality and extensibility and you fall back on trusting a validator set. That trade is why the market is full of bridges that look superficially similar but carry wildly different risk.

The trilemma maps onto three verification models. Native verification means the destination chain checks the source chain’s consensus itself, which is the strongest and the hardest to build. External verification hands the job to a separate committee, whether a plain multisig, a multi-party computation signing group, or a proof-of-stake validator set. Local or optimistic verification lets a transaction through provisionally and relies on at least one honest watcher to challenge a lie within a time window. Each model has a signature failure mode, summarized below.

Vitalik’s warning: multi-chain yes, cross-chain no

In January 2022, weeks before the worst of the bridge hacks, Ethereum co-founder Vitalik Buterin posted a warning that aged unusually well. He argued for a future with many blockchains but against moving assets freely across them, citing what he called the fundamental security limits of bridges. His core example is worth sitting with. Move 100 ETH onto a bridge on another chain to get 100 wrapped ETH there, he wrote, and then imagine Ethereum suffers a 51 percent attack. An attacker can deposit their own ETH, obtain the wrapped version, and reverse the deposit on the Ethereum side once the other chain has confirmed it. The wrapped token is no longer fully backed, and, in his words, “your 100 Solana-WETH is now only worth 60 ETH.”

The deeper point is about contagion. A single chain can absorb a 51 percent attack and keep most of its guarantees, because honest users can socially coordinate around the valid history. A bridge cannot. The moment many chains share liquidity through interconnected bridges, an attack on the weakest link does not stay contained; it drains collateral that backs assets scattered across every connected chain. A bridge inherits the weaker of the two chains’ security, then adds its own attack surface on top. Buterin’s conclusion, that holding native assets on their home chain is safer than scattering wrapped versions everywhere, is still the cleanest one-sentence risk model in the space.

The attack surface: where bridges actually break

Bridge failures cluster into a small number of categories, and almost every nine-figure loss fits one of them. The first and most costly is key compromise. When a bridge is secured by an external committee, its keys become the target, and those keys are only as safe as the laptops and processes around them. Attackers phish an engineer, compromise a server, or exploit a standing approval, collect enough signatures to cross the signing threshold, and sign themselves a withdrawal. This is a human and operational problem more than a cryptographic one, which is exactly why it keeps happening. The same supply-chain and endpoint weaknesses that make hardware wallet key custody so hard to get right apply, at far larger scale, to the handful of keys that guard a bridge vault.

The second category is a bug in the verification code itself. If the function that checks a signature or a Merkle proof can be tricked into accepting a forged one, the attacker does not need any keys at all; they just hand the bridge a fake receipt it is willing to believe. The third is upgrade and admin risk: many bridges can be upgraded by a multisig or a single admin key, which means whoever controls that key can quietly rewrite the rules or push a change that opens a hole. The fourth is social engineering and insider access, the category that turns a well-designed system into a liability because one person was tricked or compromised. The methods that drain individual wallets, like the SIM-swap takeovers we covered in our report on phone-number hijacking and crypto theft, are the same techniques used to pivot into the accounts of the engineers who hold bridge keys.

Ronin: $625 million and five stolen keys

The Ronin bridge, built by Sky Mavis to support the hit game Axie Infinity, is the textbook case of key compromise, and it remains the largest bridge theft on record. On 23 March 2022, attackers drained roughly 173,600 ETH and 25.5 million USDC, worth about $625 million at the time. Ronin used a validator set of nine, with five signatures required to authorize a withdrawal. The attackers obtained four keys controlled by Sky Mavis directly, then used a standing authorization the company had granted the Axie DAO months earlier to clear the fifth. Five of nine, threshold met, vault open.

The entry point was mundane. An engineer was targeted through a fake job offer, the kind of elaborate social-engineering lure that has become a signature of state-linked crews. The attack was not even noticed for six days; the team found out when a user could not withdraw funds. The United States Treasury later attributed the theft to the North Korea-linked Lazarus Group, tying it to a pattern of DPRK operations funding the regime through crypto theft. The lesson Ronin burned into the industry is that a small validator set plus convenience shortcuts like a standing approval is not a security model, it is a single point of failure wearing the costume of decentralization. Sky Mavis later expanded the validator set and rebuilt its processes, but the damage set the tone for the entire year.

Wormhole: $320 million and a signature check that wasn’t

If Ronin shows what happens when keys are stolen, Wormhole shows what happens when the code that checks signatures is wrong. Wormhole connects Solana to Ethereum and other chains using a set of guardian validators whose signatures authorize mints. On 2 February 2022, an attacker exploited a flaw in the Solana-side contract that let them bypass the guardian signature check entirely, using a deprecated function to slip a forged verification past the bridge. With that single gap, they convinced the bridge that a deposit had occurred and minted 120,000 wrapped ETH, worth around $320 million, out of thin air.

No keys were stolen. The validators were honest. The entire loss flowed from one function that was supposed to confirm the guardians had signed and did not do its job. That is the brutal fragility of external verification: the committee can be perfectly trustworthy and the bridge can still be drained if the code wrapping them has a single hole. Wormhole survived only because its backer, trading firm Jump Crypto, replaced the missing 120,000 ETH from its own balance sheet to keep wrapped-asset holders whole, a bailout very few bridges could count on. The team also offered a multimillion-dollar bounty for the funds’ return. Wormhole later rebuilt toward stronger verification, but the episode is still the clearest demonstration that a bridge’s security is exactly as strong as its single most important line of code.

Nomad: $190 million and the crowdsourced hack

Nomad produced the strangest bridge failure of all, a theft with no single thief. Nomad used an optimistic model in which messages were assumed valid unless challenged. During a routine contract upgrade in August 2022, a configuration change marked a zero value as a trusted root, which had the unintended effect of making every message look already proven. The result was a bridge that would approve essentially any withdrawal request you sent it. Once one person noticed, the exploit required no skill to copy: take a working transaction, swap in your own address, and resubmit.

What followed, according to a detailed post-incident analysis by security firm Immunefi, was a chaotic free-for-all in which an estimated several hundred addresses raced to drain the vault before it ran dry, carrying off around $190 million. It was the purest illustration of crypto’s “dark forest,” the predator-rich environment where any profitable opportunity left in the open is pounced on instantly, a dynamic we traced in detail in our piece on who profits in the MEV dark forest. Nomad later recovered more than $20 million from white-hat participants who returned funds. The lesson is about process, not cryptography: a one-line configuration change pushed in an upgrade turned a functioning bridge into an unlocked bank, and nobody caught it before the forest did.

The rest of the hall of infamy

The same handful of failure modes repeat across the other landmark incidents. Harmony’s Horizon bridge was drained of around $100 million in June 2022 after attackers compromised a two-of-five multisig, a threshold so low that two stolen keys were enough; by that point more than $1 billion had already been stolen from bridges in 2022, and the FBI later tied Horizon to Lazarus as well. The BNB Chain Token Hub was hit in October 2022 when an attacker forged proofs in the bridge’s Merkle verification system; as security firm Halborn documented, the exploit conjured roughly 2 million BNB, but validators coordinated a rapid halt of the chain that limited the funds which actually escaped to a fraction of the amount minted.

Not every story ends in loss. The Poly Network exploit of August 2021 was briefly the largest in DeFi history, with an attacker abusing a flaw that let them reassign the bridge’s privileged keeper role and authorize their own transfers of more than $610 million. Then something unusual happened: the attacker gave almost all of it back, and Poly Network took to calling them “Mr. White Hat” and offered a bounty and a job. Multichain’s collapse in July 2023 was grimmer and more quietly damning. Around $126 million moved to unknown addresses, but the root cause was not a clever exploit; it was that one person, the CEO, held sole control of the bridge’s keys and servers, and he had been detained by Chinese police. The protocol simply stopped. The table below lines up the worst of them.

Following the money: Lazarus, Tornado Cash, and the regulators

Bridge theft is not a victimless technical curiosity; it funds a weapons program. Chainalysis estimated that North Korea-linked actors accounted for roughly half of the value stolen from bridges and DeFi in 2022. Stolen funds then flow into mixers to break the on-chain trail, and that is where the heists collided with United States enforcement. On 8 August 2022, the Treasury’s Office of Foreign Assets Control sanctioned the mixer Tornado Cash, citing its use to launder more than $455 million stolen by Lazarus, over $96 million from the Harmony bridge, and at least $7.8 million from Nomad. “Today, Treasury is sanctioning Tornado Cash, a virtual currency mixer that launders the proceeds of cybercrimes, including those committed against victims in the United States,” said Under Secretary for Terrorism and Financial Intelligence Brian E. Nelson. It was the first time a piece of code, rather than a person or company, had been placed on the sanctions list, a novel move that drew sustained legal challenges over whether immutable smart contracts can be sanctioned at all.

Where does the Securities and Exchange Commission fit? Mostly at the edges. The SEC’s crypto attention has centered on whether tokens are unregistered securities and on custody obligations, not on bridge engineering, so there is no landmark SEC bridge-safety case to point to. The gray areas it does touch are real: a wrapped asset is a claim on collateral held by a third party, which raises custody questions, and a bridge’s governance token can look like a security depending on how it is marketed. For the thefts themselves, the enforcement muscle has come from the Treasury, the Department of Justice, and the FBI through sanctions and criminal cases, not from securities law. Anyone trying to understand where the rules are actually being written should watch the broader fight over whether DeFi infrastructure is regulated as a service or treated as neutral software, a debate that will shape bridge operators far more than any single exploit.

The threat has also moved up-market. Chainalysis reported that more than $3.4 billion was stolen across crypto in 2025, with North Korea-linked crews responsible for over $2 billion of it, and the single largest theft of all time was not a bridge at all but the roughly $1.5 billion Bybit exchange hack in February 2025. That shift is itself a sign that hardened bridges pushed attackers toward exchanges, custodians, and insider infiltration. Bridges got harder; the adversary got richer and more patient.

How bridges got safer: light clients, zk proofs, and native verification

The industry did learn. The clearest trend since 2022 is a migration away from small external committees toward verification rooted in cryptography. Light clients, where the destination chain verifies the source chain’s block headers and consensus directly, remove the need to trust an outside committee at all. The Cosmos ecosystem’s Inter-Blockchain Communication protocol has run this model at scale for years and is widely treated as the trust-minimized gold standard, because the chains verify each other rather than delegating to a third party.

Zero-knowledge proofs push the idea further. Instead of re-running a chain’s consensus, a prover generates a small cryptographic proof that a particular event happened, and the destination chain checks the proof cheaply. Teams such as Polyhedra and Succinct have brought zk light clients into production, and the collapsing cost of proving has made this economically viable in a way it was not a few years ago. Where committees survive, they have hardened: multi-party computation signing now often runs inside trusted execution environments, critical contracts get formal verification, and bridges increasingly add rate limits and circuit breakers that cap how much can move in a short window, so a single exploit cannot empty the vault before a human notices. The result shows in the data, with bridge-specific losses falling sharply from the 2022 peak even as the overall dollar value of crypto theft rose.

Canonical versus third-party bridges, and the modern interop stack

For anyone moving funds between Ethereum and its layer two rollups, the single most useful distinction is canonical versus third-party. A canonical bridge is the official bridge operated by the rollup itself, and it inherits the security of Ethereum’s consensus plus the rollup’s own proof system. That makes canonical bridges the safest option available, with one notable cost: withdrawing from an optimistic rollup back to Ethereum carries a challenge window, commonly about seven days, during which anyone can submit a fraud proof against an invalid withdrawal. The delay is the price of not trusting anyone.

Third-party bridges and messaging layers fill the gap for speed and for connecting chains that have no shared settlement layer. LayerZero popularized a model in which applications choose their own decentralized verifier network, flexible but only as safe as the configuration a team picks. Chainlink’s Cross-Chain Interoperability Protocol layers an independent risk-management network on top of its validators as a defense-in-depth check. Wormhole continues to run a fixed guardian set while moving toward native and zk verification. Intent-based systems like Across flip the model entirely: you state the outcome you want, a competitive network of solvers fronts you the funds on the destination chain in seconds, and the slow settlement happens behind the scenes, which keeps the user experience fast while concentrating risk in the messaging layer underneath rather than in a giant locked vault.

An emerging answer to the committee problem is shared economic security. Rather than a bridge bootstrapping its own validator set and its own token, it can rent security from restaking networks, where operators post stake that can be slashed for misbehavior, aligning real money against dishonesty. The operator economics of that model, and the question of who actually runs the infrastructure, are the same ones we examined in our look at SSV restaking and the operators who run it. Shared security does not eliminate trust, but it can make lying provably expensive, which is the direction the whole field is heading.

How to evaluate a bridge before you trust it with money

You do not need to read Solidity to assess a bridge. You need to ask who verifies your transaction, what it would cost them to lie, and who can change the rules. The checklist below captures what separates a durable bridge from a trap, and most of it can be answered from documentation and independent monitors in a few minutes.

• Who verifies, and how: prefer a rollup’s canonical bridge or a native, light-client, or zk-based design over a bridge secured by a small external committee. If it relies on a multisig, how many signers, and how high is the threshold?
• Who can upgrade it: find out whether the contracts are upgradeable, who holds the admin keys, and whether changes pass through a timelock that gives users warning. An instant-upgrade admin key is a bridge within the bridge.
• Audits and formal verification: look for multiple independent audits and, for the critical verification contracts, formal verification. One audit badge is a floor, not a guarantee, and fake or stale audit claims are common.
• Safety brakes: check for rate limits, circuit breakers, and a credible pause mechanism that can cap damage if something goes wrong.
• Track record and monitoring: favor bridges that have survived real volume for a long time, and cross-check live risk profiles on an independent monitor such as L2BEAT’s bridge dashboard, which scores validator-set size and key custody.
• Your own exposure: never bridge more than you can afford to lose, do not leave large balances parked in wrapped assets, and move big amounts in smaller batches so a single failure does not catch everything at once.

Bridges are infrastructure that will not disappear, because a multi-chain world needs them. But the history is unambiguous about which designs survive contact with a determined adversary. The ones that trusted a small committee and a fast upgrade key were drained. The ones moving toward chains verifying each other, with real money staked against lies and brakes that limit a single bad day, are the ones worth your capital. Read the trust assumption before you read the yield.

Frequently Asked Questions

Are crypto bridges safe to use in 2026?

Bridges are meaningfully safer than during the 2022 wave of nine-figure thefts, but they remain one of the higher-risk pieces of crypto infrastructure. The safest options inherit the security of the chains they connect, through light clients, zero-knowledge proofs, or a rollup’s canonical bridge. The riskiest still depend on a small committee of external signers whose keys can be stolen. Always check how a bridge verifies transactions before you use it.

What was the biggest bridge hack ever?

The Ronin Network bridge behind Axie Infinity lost about $625 million in March 2022 when attackers stole five of its nine validator keys, the largest bridge theft on record. Poly Network lost more than $610 million in 2021, but the attacker returned almost all of it. The largest crypto theft of any kind is the roughly $1.5 billion Bybit exchange hack in February 2025, although that was an exchange rather than a bridge.

Why do crypto bridges get hacked so often?

Bridges lock real assets in a vault on one chain while issuing claims on another, so they concentrate huge sums in a single place. Many of them also shortcut the hard part of verification by trusting a small set of signers or an upgradeable contract. A large pot of money guarded by a thin trust assumption is the most attractive target in crypto, which is why Chainalysis found bridges accounted for most of the value stolen in 2022.

What is a trust-minimized or trustless bridge?

A trust-minimized bridge verifies cross-chain events using cryptography and the connected chains’ own consensus rather than a separate group of validators you have to trust. Light clients, which check block headers directly, and zero-knowledge proofs, which produce a succinct receipt that an event happened, are the leading approaches. The Cosmos IBC protocol and newer zk light clients from teams like Polyhedra and Succinct are the closest things to this ideal running in production.

How can I reduce my risk when using a bridge?

Prefer a rollup’s canonical bridge or a native, light-client, or zk-based design over one secured by a small external committee. Look up who can upgrade the contracts and whether those keys sit behind a timelock. Check independent monitors such as L2BEAT, never bridge more than you can afford to lose, and move large amounts in smaller batches so a single failure does not catch everything at once.

By the HOGE Wire DeFi desk, covering on-chain security, cross-chain infrastructure, and the economics of crypto risk.