Bridge Security Explained: How Cross-Chain Trust Works in 2026

Every blockchain is an island. Ethereum cannot natively see what happens on Solana, Solana cannot read Bitcoin, and no chain has a built-in way to confirm the state of another. Yet the assets living on those chains want to travel. A trader holding USDC on Ethereum wants to use a Solana app; a Bitcoin holder wants yield on an Ethereum lending market; a game studio wants its token liquid on five networks at once. Bridges are the machinery that makes those moves possible, and they have quietly become the most dangerous piece of plumbing in decentralized finance.

The reason is structural. A bridge is where value pools and where trust concentrates. Lock billions of dollars behind a handful of signatures, publish the exact contract that releases those funds, and you have built the most profitable target in crypto. According to Chainalysis, attackers stole roughly $2 billion across 13 separate bridge hacks in 2022 alone, about 69% of all crypto theft that year. Four years later, bridges are still leaking. This piece is not another hack timeline (HOGE Wire has written those). It is a working guide to how bridge security actually functions: the trust models, the verification mechanics, the attack surface that keeps getting drained, and how to judge whether a given bridge deserves your money.

What a Blockchain Bridge Actually Does

Strip away the branding and every bridge solves one problem: it convinces a smart contract on chain B that something specific happened on chain A. You deposited 10 ETH on Ethereum, so the bridge should hand you a claim worth 10 ETH on Arbitrum. The hard part is the word convince. Chain B has no eyes on chain A. It cannot run Ethereum’s consensus, and it will believe whatever its own rules tell it to believe. A bridge is the system that produces that belief, and the entire security question reduces to how that belief is manufactured and how hard it is to fake.

Most bridges move value in one of two ways. In the lock-and-mint model, the bridge locks your real asset in a vault on the source chain and mints a wrapped representation (a bridged version of ETH, say) on the destination. Burn the wrapped token later and the original unlocks. In the liquidity-network model, the bridge never mints anything; it keeps pools of the real asset on both sides and pays you out of the destination pool while it rebalances behind the scenes. The distinction matters for security because it changes what an attacker can steal: a vault of locked collateral, the right to mint unlimited wrapped tokens, or a drainable liquidity pool. Each failure mode has its own signature, and each has produced nine-figure losses.

Why Bridges Became Crypto’s Biggest Honeypot

Bridges concentrate risk in a way few other DeFi primitives do. A lending market can be drained of one asset; a bridge can be drained of everything it holds, across every chain it touches, in a single transaction. Tens of billions of dollars sit in bridge vaults and wrapped-asset reserves at any given time (you can watch the live totals on DeFiLlama’s bridged-value dashboard), and unlike a centralized exchange, a bridge publishes its own attack surface: the verifier set, the contract addresses, and the exact conditions under which funds release are all onchain for anyone to study.

The economics are brutal. A researcher who finds a bug in a bridge is not looking at a bug bounty; they are looking at the entire balance. That asymmetry has drawn the most capable attackers in the world, including state-sponsored groups. TRM Labs counted a record 207 crypto hacks in the first half of 2026, and although total losses fell to about $972 million (down roughly 57% from the same period a year earlier), the money was heavily concentrated in a few catastrophic infrastructure breaches, several of them at bridges. That pattern is the whole story of this article: many small smart-contract bugs, a handful of enormous key-and-infrastructure failures.

The Trust Question: Who Verifies a Cross-Chain Message?

Because no chain can read another, every bridge outsources the question did this really happen to some verification system. That system is the bridge’s true security model, and the audit firm Sherlock groups the industry’s approaches into a small number of families: external committees that attest to events, configurable verifier networks, optimistic systems that assume honesty and allow disputes, and light-client or zero-knowledge designs that verify the source chain cryptographically. Sherlock separates the failures into three layers too: consensus (reorgs, finality mismatches, validator bribery), transport (relayer censorship, replayed or withheld messages, forged attestations), and application (authorization bugs, confused-deputy calls, arbitrary function execution).

The families sit on a spectrum from trust these people to trust this math. The table below sketches the trade-offs. Read it as a map of where each bridge places its faith, because that is exactly where an attacker will aim.

External Verification: Multisigs, Guardians, and Validator Committees

The most common bridge design, and historically the most exploited, hands verification to an external committee. A fixed group of signers watches the source chain and collectively attests that a deposit happened; once a threshold of them signs, the destination releases funds. Wormhole uses 19 guardians and requires 13 of them to approve a message. Ronin used a 5-of-9 validator multisig. The appeal is speed and simplicity; the weakness is that the whole system collapses if enough signers are compromised.

That is not theoretical. Ronin, the sidechain behind Axie Infinity, lost about $625 million in March 2022 when attackers linked to North Korea’s Lazarus Group phished their way into enough validator keys to hit the five-signature threshold; Sky Mavis directly controlled four validators, and a fifth had delegated its signing back to the company and never revoked it, so compromising one organization was enough, as CoinDesk reported. Harmony’s Horizon bridge fell the same way three months later, drained of about $100 million because its multisig required only 2 of 5 signatures. Wormhole’s $325 million loss in February 2022 came from a different flavor of the same problem: a bug in its signature verification let an attacker forge a message the guardians never actually signed, per a Halborn post-mortem. Jump Crypto replaced the stolen funds within a day, one of the rare times a backer simply ate a nine-figure loss to keep a bridge alive.

Lock-and-Mint, Burn-and-Mint, and the Wrapped-Asset Problem

How a bridge represents your asset on the far side is its own security dimension. In the classic lock-and-mint approach, the destination token is an IOU: it is worth something only because the bridge promises real collateral is locked somewhere else. If an attacker can mint that IOU without depositing anything, they can print money and dump it, and the wrapped token depegs to zero. The Nomad disaster in August 2022 was exactly this: a botched upgrade set the contract’s trusted root to a blank value, which happened to match the default for unproven messages, so every withdrawal request validated automatically. Google’s Mandiant analysts called what followed decentralized robbery, as hundreds of strangers copied the first attacker’s transaction, swapped in their own wallet address, and helped drain roughly $190 million.

A cleaner model has gained ground since. Circle’s Cross-Chain Transfer Protocol (CCTP) burns native USDC on the source chain and mints fresh native USDC on the destination after an attestation, so there is never a thinly-backed wrapper floating around; the token on the far side is the real thing, issued by Circle itself. Canonical rollup bridges (the official Arbitrum or Optimism bridges) run on similar lock-and-mint logic but inherit the security of the rollup’s own proof system rather than an external committee. The lesson that took the industry years and billions to absorb is blunt: the safest wrapped asset is one that is barely wrapped at all, and the mint authority is the single most valuable key in the whole design. For a deeper look at how pooled liquidity and pricing curves behave under pressure, our explainer on automated market maker design covers the mechanics that liquidity-network bridges lean on.

Optimistic and Light-Client Bridges: Trust Minimized, With Trade-offs

The more ambitious designs try to shrink the amount of trust you place in any group of people. Optimistic bridges borrow the logic of optimistic rollups: a message is accepted by default, and anyone can challenge it within a dispute window by posting a bond. If no honest watcher objects in time, a fraudulent message goes through, so the model trades instant finality for a delay and depends on at least one funded, awake challenger. Across pairs an optimistic settlement layer with a competitive network of relayers; the user gets paid quickly from relayer inventory while the slow verification happens in the background.

Light-client and zero-knowledge bridges go further and try to remove human verifiers entirely. A light client runs a compact version of the source chain’s consensus inside a contract on the destination chain, so the destination can check the source’s block headers itself; this is how the Cosmos ecosystem’s IBC protocol connects dozens of chains. Validity or ZK bridges (Polyhedra’s zkBridge is a prominent example) post a succinct cryptographic proof that a source-chain event occurred, which the destination verifies mathematically rather than trusting anyone’s word. These designs are the closest thing to trust the math that bridging offers, but they are expensive to build, computationally heavy, and slow to cover the long tail of chains, which is why committee-based bridges still dominate by volume.

The Modern Stack: DVNs, Risk Networks, and the Flight to Safety

Today’s leading messaging layers try to make trust configurable instead of fixed. LayerZero V2 replaced its old oracle-and-relayer setup with Decentralized Verifier Networks (DVNs); an application chooses a security stack described as X of Y of N, meaning X required verifiers plus a threshold Y drawn from a pool of N optional ones must all confirm the same message hash before it is delivered, per LayerZero’s documentation. A cheap NFT transfer might use a 1/1/1 stack; a treasury bridge should use something like 5/20/25. The flexibility is powerful and dangerous in equal measure, because the bridge is only ever as safe as the configuration the application actually picked.

That danger became concrete in April 2026. Attackers drained about $292 million in restaked ETH (rsETH) from a LayerZero-powered KelpDAO deployment, not by breaking any contract but by compromising the internal infrastructure feeding a single verifier while the configuration was set to require just one. Within weeks, roughly $4 billion in bridged assets voted with their feet: Kraken’s kBTC, Lombard’s billion-dollar-plus book of Bitcoin-backed tokens, and Solv’s $700 million in tokenized Bitcoin all migrated toward Chainlink’s CCIP, as CoinDesk documented. “We are witnessing a continued flight to safety across the industry,” Chainlink Labs chief business officer Johann Eid told the outlet. CCIP’s pitch is defense in depth: a separate Risk Management Network, written by a different team in a different language from the core protocol, watches every lane for anomalies and can throttle or halt suspicious flows, a design its co-founder Sergey Nazarov sums up as “defense in depth, not blind trust.” The restaking assets at the center of that exodus are unpacked in our guide to restaking and the demand for rented security.

Intents and Solvers: How Bridging Got Faster

The newest wave of cross-chain design barely looks like a bridge at all. Intent-based systems let you declare the outcome you want (“I want 1,000 USDC on Base”) and let a competitive network of solvers work out how to deliver it. A solver fronts you the funds on the destination chain immediately out of its own inventory, then reimburses itself later once the slow cross-chain verification settles. Because the solver absorbs the waiting time, users get near-instant transfers, and Across reports that this structure can compress fees by 30% to 70% versus a traditional canonical bridge.

Intents improve the experience, but they relocate the security question rather than dissolve it. You now trust that the solver network is honest and that the underlying settlement layer (often an optimistic system or CCTP) will eventually verify correctly; if it does not, the solver, not the user, usually takes the loss, which is a genuine improvement. The trade-off is added complexity and a new dependency on liquidity providers who can decline to serve a route. As bridging folds into wallets and aggregators, this plumbing increasingly disappears behind the interface, part of the same shift toward invisibility we traced in our look at how crypto wallets finally got usable.

The Real Attack Surface: Keys and Infrastructure, Not Code

Here is the single most important fact about bridge security in 2026, and it cuts against the popular image of a genius hacker spotting a subtle Solidity bug. Most of the money is not stolen through code at all. TRM Labs found that infrastructure and operational compromises, meaning stolen private keys, leaked credentials, and hijacked signing systems, accounted for only about 15% of incidents in the first half of 2026 but drove roughly 76% of all value lost. Smart-contract exploits were far more numerous yet accounted for a small slice of the dollars. The expensive failures are almost never the contract had a bug; they are someone got the keys.

The case files bear this out with grim consistency. Ronin was a phished job offer that delivered malware to an engineer. The KelpDAO loss came from compromised RPC infrastructure feeding a verifier, not a flawed contract. TRM even documented a 2026 incident in which a developer’s malware-infected laptop leaked the private keys tied to a protocol’s bridge infrastructure, worth tens of millions. Ben Fisch, chief executive of Espresso Systems, put the KelpDAO failure in one sentence to CoinDesk: “The bridge worked as designed. It just believed the wrong information.” That is the whole problem in miniature. Most bridges do not independently verify what happened on another chain; they rely on a smaller, softer system to report it, and that reporting system (the keys and servers behind it) is what actually gets attacked. The blind-signing risk that lets a single compromised key approve a malicious transaction is the same weakness that plagues personal wallets, and it scales terrifyingly when the key controls a bridge instead of one account.

Anatomy of the 2026 Wave: Same Lessons, New Victims

If the mechanics were fully understood, you would expect the losses to stop. They have not. PeckShield tallied bridge-specific losses topping $328 million across 2026 by mid-year, and the summer added a fresh run of incidents that repeated old mistakes almost verbatim. Taiko’s bridge lost about $1.7 million in June after an engineer accidentally exposed an SGX signing key on GitHub, though the team refilled reserves and reopened within ten days, as CoinDesk noted. In July, the Arbitrum-based perpetuals venue AFX Trade was drained of $24.15 million when its validator signing keys were compromised; this was a bridge layered on top of Arbitrum, not Arbitrum’s own bridge, which co-founder Steven Goldfeder was quick to point out had “not been hacked or exploited in any way,” per CoinDesk.

Two cases stand out because the victims had already learned the lesson once. Allbridge was hit by a $1.65 million flash-loan manipulation of its liquidity pools in July 2026, the same class of attack that had cost it several hundred thousand dollars back in 2023; the structural fix it promised the first time was never extended to the deployment that got drained, CryptoTimes reported. Verus’s Ethereum bridge was exploited twice in nine weeks (about $11.6 million in May and another $7.5 million in July) through the same vulnerability class, just by a different attacker the second time. The through-line is not exotic cryptography; it is exposed keys, unpatched known bugs, and configurations documented as unsafe and shipped anyway.

What Happens After a Bridge Breaks

A hack is not always the end. What separates the bridges that survive from the ones that vanish is usually the strength of the balance sheet and the backers standing behind them, not the elegance of the code. Wormhole lived because Jump Crypto replaced 120,000 ETH almost overnight. Poly Network, which lost more than $610 million in August 2021 to a privileged-call exploit, got nearly all of it back after the attacker (addressed politely as Mr. White Hat) returned the funds following a public negotiation, per Kraken’s breakdown. KelpDAO recovered because a coalition of DeFi protocols rebuilt the rsETH backing over about five weeks so no losses reached users.

The counter-example is Multichain, which did not die from a clever exploit but from a governance and custody failure: its chief executive was reportedly detained in China in 2023, the team lost access to the MPC infrastructure he alone controlled, and roughly $130 million moved to unknown addresses before the protocol shut down entirely, as CoinDesk chronicled. That is the difference between a solvable incident and a fatal one, and it maps closely onto the survival calculus we examined in why some crypto protocols survive a hack and others die. A bridge with a single point of custody has no recovery path when that point fails.

How to Evaluate a Bridge Before You Use It

You cannot audit a bridge’s code yourself, but you can ask better questions than most users do. The single most useful one is this: who or what has to be compromised for my funds to disappear? If the honest answer is one company’s servers or a small multisig the team controls, you are trusting an operator, not a protocol. If the answer is multiple independent verifiers, or a validity proof, plus a risk network that can halt anomalies, the security is spread across parties who would all have to fail at once.

A few practical signals separate hardened bridges from fragile ones. Look for a verification model with real redundancy; a large and diverse signer set with timelocked upgrades (so a compromised admin key cannot instantly rewrite the rules); multiple audits and a live bug bounty; rate limits or circuit breakers that cap how much can leave in one transaction; and an asset model that uses native mint-and-burn or a canonical bridge rather than a thin wrapper with opaque backing. The checklist below is not exhaustive, but a bridge that fails several of these tests is telling you where it will break.

The Regulatory Angle: Sanctions, Wrapped Assets, and the SEC

Bridges sit in an awkward legal spot. When funds are stolen, they usually flee through mixers, and the US Treasury has repeatedly reached for sanctions in response. In August 2022 the Office of Foreign Assets Control sanctioned Tornado Cash, citing more than $7 billion laundered including funds traced from the Ronin, Harmony, and Nomad bridge hacks, per a Treasury announcement. The move ran into a wall: a federal appeals court ruled in late 2024 that OFAC had overstepped by sanctioning immutable smart contracts no one controls, and Treasury delisted Tornado Cash in March 2025, as Forbes reported. The same property that makes bridges hard to secure (code that runs with no operator once deployed) also makes them hard to sanction after the fact.

There is a securities dimension too. A wrapped or bridged token is, in effect, a claim on collateral held elsewhere, and US regulators have not fully settled how such instruments should be classified or who is liable when the backing evaporates. For issuers and exchanges, that ambiguity is a live risk, and it interacts with the broader enforcement posture we mapped in our field guide to how SEC crypto enforcement works in 2026. For now, criminal cases against individuals (the Nomad suspect was extradited to the United States) have held up better than sanctions against protocols, a hint at where accountability is likely to land.

Where Bridge Security Goes Next

The direction of travel is clear even if the destination is not. Configurable trust is hardening: after the KelpDAO loss, LayerZero raised its verifier minimums so production deployments can no longer run on a single DVN. Risk networks and circuit breakers are becoming table stakes rather than luxuries. And the long-promised shift toward zero-knowledge and light-client verification is slowly moving from research into production, pushed hardest by people who think committees are a dead end. After the Wanchain hack that drained its Cardano bridge in July 2026, Cardano founder Charles Hoskinson argued to CoinDesk that “all software is under this enormous assault” from automated, AI-assisted vulnerability hunting, and that the industry should replace trust in bridge operators with zero-knowledge proofs entirely.

Not everyone believes cross-chain bridging can ever be truly safe. Ethereum co-founder Vitalik Buterin argued years ago, and has not recanted, that “there are fundamental limits to the security of bridges that hop across multiple ‘zones of sovereignty,’” making the case for a multi-chain world connected by rollups rather than a cross-chain one stitched together by bridges, in comments reported by Cointelegraph. The likely future is neither pure pessimism nor a silver bullet: fewer trusted committees, more validity proofs and defense-in-depth, native issuance instead of thin wrappers, and a slow migration of value toward designs that force an attacker to compromise many independent parties rather than one. Bridges will keep breaking. The open question is whether the next break costs $292 million or $2,920, and that number is decided almost entirely by the trust model you chose before you clicked confirm.

Frequently Asked Questions

What is a blockchain bridge in simple terms?

A blockchain bridge is a system that lets assets and data move between separate blockchains that cannot natively communicate with each other. It typically locks or burns your token on the source chain and issues an equivalent token on the destination chain, then reverses the process when you bridge back. Its security comes down to how convincingly it proves to the destination chain that the source-chain event really happened.

Why do crypto bridges get hacked so often?

Bridges concentrate large amounts of value behind a small, public set of rules, which makes them one of the most profitable targets in crypto. The most damaging attacks rarely exploit a smart-contract bug; according to TRM Labs, roughly 76% of 2026’s stolen value came from compromised keys, credentials, and infrastructure. When attackers seize the keys or servers that verify cross-chain messages, they can drain much of what a bridge holds in a single transaction.

Are cross-chain bridges safe to use in 2026?

Safety varies widely and depends entirely on the trust model. A bridge secured by multiple independent verifiers or a validity proof, with rate limits and anomaly monitoring, is far more robust than one guarded by a single company’s signers. You can lower your risk by favoring native mint-and-burn transfers such as Circle’s CCTP for USDC, or canonical rollup bridges, and by not leaving large balances in wrapped tokens longer than necessary.

What is the safest type of crypto bridge?

In general, the most trust-minimized designs are light-client and zero-knowledge (validity) bridges, which verify the source chain cryptographically instead of trusting a committee of signers. Native mint-and-burn systems such as Circle’s CCTP also avoid the thin-wrapper risk that has sunk many bridges. No design is risk-free, but bridges that force an attacker to defeat many independent parties at once are structurally much harder to drain.

What happens to my money if a bridge gets hacked?

It depends on the bridge’s backing and governance. Some incidents end well: Wormhole’s backer replaced the stolen funds, and a coalition of protocols rebuilt KelpDAO’s collateral so users were made whole. Others are fatal, as with Multichain, where the loss of custody keys left no recovery path and the protocol shut down. Whether you get reimbursed usually comes down to who stands behind the bridge, not the size of the hack.

By Daniel Voss, senior markets writer at HOGE Wire, covering DeFi infrastructure and onchain security.