A bridge hack is an attack that exploits a weakness in the code, message verification, keys, configuration, liquidity, or operations used to move assets or messages between blockchains. Bridges do not all work the same way: some lock assets and mint wrapped versions, others burn and mint, swap liquidity, or verify cross-chain messages. The shared security challenge is that a destination chain must decide whether an event on another chain is genuine, while often relying on additional contracts, relayers, validators, or proof systems.
How Bridge Attacks Work
A bridge generally observes an event on one chain, checks that it meets the bridge’s rules, and then triggers a corresponding action elsewhere. That action could be releasing escrowed tokens, minting a wrapped asset, or carrying out a message. A failure in any step can let an attacker create a false authorization, steal assets held in custody, or exploit an assumption shared by connected protocols.
Some bridges use a validator or guardian set; others rely on light clients, fraud proofs, liquidity providers, or the connected chains themselves. The design determines which parties and components users must trust. The label “bridge” alone does not describe its security model.
Common Bridge Failure Modes
- Message or proof verification bugs: a contract accepts a forged, replayed, or improperly validated cross-chain message. The 2022 Nomad incident followed an upgrade that caused an unset zero value to be treated as a trusted root, allowing messages to be processed without the expected validation.
- Validator, guardian, or administrator key compromise: an attacker obtains enough signing power to authorize withdrawals or messages. In the Ronin incident, five of nine validator keys were used to approve fraudulent withdrawals.
- Unsafe upgrades or configuration: a code change, permission setting, signature threshold, or emergency process introduces a path around the intended safeguards.
- Liquidity and accounting assumptions: a bridge may release or mint more value than it has secured, or an asset may lose its expected backing after an exploit.
- Monitoring and response gaps: unusual activity may not be detected or halted quickly. Pause controls can limit damage, but they also create operational and governance trade-offs.
Major Bridge Hacks
Ronin: Fraudulent withdrawals of 173,600 ETH and 25.5 million USDC were authorized through compromised validator keys. The withdrawals occurred on March 23, 2022, and the breach was discovered on March 29. Ronin later described plans to expand the validator set and introduce additional withdrawal safeguards. The incident demonstrates that multisignature security depends on who controls the signers, how access is managed, and whether delegated permissions are revoked when no longer needed.
Wormhole: In February 2022, an attacker bypassed a verification step in the bridge’s Solana-side program and caused 120,000 wrapped ETH to be minted without the corresponding deposit. This was a verification and account-validation failure, rather than a simple theft of tokens from a conventional lockbox.
Nomad: In August 2022, a contract upgrade left the zero value accepted as a valid message root. Attackers could therefore submit messages that the bridge treated as proven; after the first exploit was visible, other users copied the pattern. This case shows how a small configuration or initialization error can become a permissionless drain when the verification boundary fails.
Reported dollar values for historic incidents depend on token prices at the time and on whether a source counts stolen assets, recovered funds, or total protocol exposure. The token quantities and the specific authorization failures are more stable facts than a single headline dollar figure.
Common Misconceptions
- “Every bridge locks tokens and mints wrapped tokens.” Lock-and-mint is one design. Burn-and-mint, atomic swaps, liquidity networks, and message-only bridges have different flows and risks.
- “An audit means the bridge is safe.” An audit reviews a defined code version and scope. It cannot guarantee that future upgrades, key management, integrations, or operational procedures are secure.
- “A multisig is automatically decentralized.” The threshold matters, but so do signer independence, custody, access controls, delegation, and the ability to change the signer set.
- “A bridge exploit only affects that bridge.” Wrapped assets and cross-protocol collateral can transmit losses or uncertainty to applications on other chains.
Criticisms and Trade-Offs
Bridges can improve access to applications and liquidity across networks, but they add dependencies that a user may not have when staying on one chain. Depending on the design, users may face smart-contract risk, validator or custodian risk, proof-system risk, wrapped-asset risk, liquidity constraints, pauses, or delays. A bridge can also become a concentrated target because it holds assets or has authority to release them.
Risk is not identical across bridges, and “trustless” does not mean risk-free. A useful review asks what is being transferred, what mechanism verifies it, who can upgrade or pause the system, how withdrawals are authorized, what happens during a chain outage, and whether the destination asset remains redeemable if the bridge fails.
Social Media Sentiment
A small Reddit discussion about recurring bridge exploits focused on the concentration of assets and trust, the possibility that bridge losses can affect liquidity and collateral on several chains, and whether ecosystems should reduce unnecessary bridging. These comments are anecdotal and do not represent all crypto users; they echo technical concerns about cross-chain dependencies rather than establish a general consensus.
Last updated: 2026-10
Related Terms
See Also
- How Do Crypto Bridges Work—and Why Are They Such a Hack Target?
- Why Smart Contract Audits Fail
- Are Layer 2 Networks Decentralized?
- Swap crypto with ChangeNOW
Sources
- Ethereum.org — Bridges — Explains major bridge designs, verification models, and the security and systemic risks users should consider.
- Mandiant — Dissecting the Nomad Bridge Hack — Documents how the zero-root validation issue let improperly verified messages be processed.
- CertiK — Wormhole Bridge Exploit Incident Analysis — Describes the Solana-side verification failure and the 120,000 wrapped ETH mint.
- Ronin Network — Ronin Bridge security-incident postmortem — The project’s postmortem reports the validator compromise, token quantities, discovery timeline, and response.
- Reddit — “Why do bridges still fail so often in DeFi?” — A small community discussion used as an example of user concerns, not as evidence of representative sentiment.