by AK Arora 
In March 2022, hackers linked to North Korea’s Lazarus Group stole more than $500 million from a single piece of crypto infrastructure most users had never heard of. Read our full North Korea crypto theft and Lazarus Group guide for more on how this group operates.
The target was not an exchange. It was not a wallet. It was the Ronin Bridge — the connection point that let players move assets between the Ethereum blockchain and Ronin, the side-chain built for the Axie Infinity game. The attackers compromised the private keys controlling the bridge and simply authorised the transfer of funds to their own wallets.
That single event remains crypto’s largest bridge hack to date. However, it is far from an isolated incident. Cross-chain bridges have collectively lost over $2.8 billion to hackers since 2022 — representing roughly 40% of all Web3 exploits by dollar value, making bridges crypto’s single most dangerous attack surface. For a broader look at crypto security risks beyond bridges, read our can crypto be hacked guide.
Despite this risk, bridges remain absolutely essential infrastructure. Without them, the multi-chain crypto ecosystem we have today simply could not function. This guide explains exactly what a crypto bridge is, how it works, and why it remains both indispensable and dangerous.
What Is a Crypto Bridge?
A crypto bridge — also called a cross-chain bridge — is a protocol that allows you to move assets from one blockchain to another. For example, sending USDC from Ethereum to Solana, or ETH from Arbitrum to Base.
This solves a fundamental technical limitation: blockchains operate as completely separate, independent networks, each with their own rules, validators, and native assets. To understand the underlying technology each blockchain runs on, read our what is blockchain technology guide. An asset native to Ethereum cannot simply appear on Solana — the two networks have no inherent way to communicate with or trust each other.
This is often described as crypto’s interoperability problem. Much like an iOS app cannot run natively on Android without some translation layer, value cannot move directly between distinct blockchain ecosystems without a bridge acting as that translation layer.
Why Do Crypto Bridges Exist?
The crypto ecosystem has evolved into a genuinely multi-chain landscape. Ethereum, Solana, Base, Arbitrum, Avalanche, and dozens of other blockchains each host their own applications, liquidity, and communities. A user wanting to access a specific DeFi protocol, NFT marketplace, or yield opportunity often needs assets to exist on that specific chain.
Without bridges, your crypto would be permanently locked to whichever single blockchain it was originally issued on. If you held ETH on Ethereum but wanted to use a promising new application on Solana, you would have no way to participate without first converting through a centralised exchange — a slower, less flexible process.
Bridges solve this by enabling direct, often near-instant movement of value across chains, expanding liquidity, improving usability, and allowing users to follow opportunities across the entire crypto ecosystem rather than being confined to a single network.
How Crypto Bridges Actually Work
Most bridges use one of two fundamental architectural approaches.
Lock-and-Mint (The Traditional Model)
This is the most common and historically most exploited bridge architecture.
Step 1 — Lock. You deposit your tokens into a smart contract on the source blockchain (for example, depositing ETH into a bridge contract on Ethereum).
Step 2 — Verify. The bridge’s validator network confirms that the deposit genuinely occurred on the source chain.
Step 3 — Mint. The bridge mints an equivalent “wrapped” version of that asset on the destination blockchain (for example, wrapped ETH, often called WETH, appearing on Binance Smart Chain).
Step 4 — Use or reverse. You can use this wrapped asset on the destination chain like any other token. To move back, you “burn” the wrapped token, and the bridge releases your original locked asset on the source chain.
This model introduces what is called wrapped asset risk — the synthetic token you receive on the destination chain is only as valuable and trustworthy as the bridge’s ability to honour redemptions. If the bridge’s locked reserves are ever drained by an attacker, the wrapped tokens in circulation become unbacked and potentially worthless.
Intent-Based Execution (The Newer Model)
A more recent architectural approach, increasingly popular by 2026, works differently.
Rather than locking and minting, you simply specify what you want — for example, “send 100 USDC from Ethereum and receive 99.8 USDC on Base.” Competitive liquidity providers then fill your order directly on the destination chain, drawing from their own existing liquidity rather than relying on a centralised locked reserve.
This intent-based model reduces certain centralisation risks associated with lock-and-mint bridges, since there is no large, single pool of locked assets representing an attractive concentrated target for attackers. However, it introduces its own dependency on having sufficient competitive liquidity providers actively serving each route.
Bridge vs Cross-Chain Swap: An Important Distinction
These terms are sometimes used interchangeably, but they describe technically different processes.
A traditional bridge moves the same asset between chains — for example, ETH on Ethereum becomes ETH on Base.
A cross-chain swap combines asset conversion and the chain move into a single step — for example, ETH on Ethereum becomes USDC on Base directly, without requiring a separate swap transaction after bridging.
Modern bridge aggregators increasingly support both, automatically routing your transfer based on whatever input and output you specify, abstracting away the underlying complexity from the end user.
Why Crypto Bridges Are So Frequently Hacked
Bridges have become crypto’s most dangerous attack surface for structural reasons that go beyond simple coding mistakes.
They concentrate enormous value in a single point. A bridge holding locked reserves for thousands of users represents an extraordinarily attractive, concentrated target compared to attacking individual wallets one at a time.
They require one blockchain to trust information from another. This is the core technical challenge. A bridge must verify that a deposit genuinely occurred on the source chain before authorising a corresponding action on the destination chain. If that verification logic — the “message-to-execution” layer — has any weakness, attackers can potentially trick the bridge into believing a fraudulent cross-chain instruction is legitimate.
Validator key compromises remain a leading attack vector. Many bridges rely on a relatively small set of validators or signers who must approve cross-chain transfers. If attackers compromise enough of these keys — as happened in the Ronin hack — they can authorise fraudulent withdrawals directly.
Configuration errors compound protocol-level risk. Even bridges built on robust underlying messaging protocols can fail if a specific project’s configuration of that protocol is flawed. The 2026 Kelp DAO exploit, where attackers allegedly stole approximately $290 million by exploiting Kelp’s LayerZero configuration — specifically its reliance on a single Decentralised Verifier Network (DVN) — illustrates this clearly. The underlying LayerZero protocol was not necessarily at fault; the specific implementation choices were.
Major Crypto Bridge Hacks: A Timeline
| Bridge | Year | Amount Stolen | Cause |
|---|---|---|---|
| Ronin Bridge | 2022 | $500M+ | Validator key compromise (Lazarus Group) |
| Wormhole | 2022 | $325M | Smart contract vulnerability |
| Harmony Bridge | 2022 | $100M | Validator key compromise |
| Various bridges | 2022-2025 cumulative | $2.8B+ | Multiple causes, ~40% of all Web3 exploits |
| Kelp DAO (LayerZero config) | 2026 | ~$290M | Single DVN configuration flaw |
| Verus Protocol Ethereum bridge | 2026 | ~$11.6M | Fake cross-chain message exploit |
| IoTeX Bridge | 2026 | $4.4M | Smart contract exploit |
The pattern across these incidents is consistent: attackers target either the validator/key infrastructure controlling the bridge, or the message verification logic that determines whether a cross-chain instruction is legitimate. As one industry security researcher noted, with smart contract code itself becoming progressively harder to exploit through improved auditing, the primary attack surface in 2026 has increasingly shifted toward people — social engineering, key compromises, and configuration mistakes — rather than purely technical code vulnerabilities.
How to Bridge Crypto Safely
Given the documented risk history, approaching any cross-chain transfer with deliberate caution is essential.
Use official or well-established bridges first. Many blockchain projects maintain their own official bridges, which are typically the most scrutinised and battle-tested option for that specific chain pair.
Check total value locked (TVL) and track record. Bridges that have operated for years with significant TVL and no major security incidents generally carry lower risk than newly launched alternatives, though no bridge is entirely risk-free.
Send a small test transaction first. Before bridging a significant amount, send a small test transfer to confirm the process works correctly and you understand each step, including any claim process required on the destination chain.
Keep enough native tokens for gas on both sides. Most bridges require you to hold sufficient native currency on the source chain to pay transaction fees, and sometimes on the destination chain as well, depending on how the claim step works.
Consider bridge aggregators for routing optimisation. Rather than manually selecting a single bridge, aggregators connect to dozens of underlying bridges and route your transfer based on fees, available liquidity, and security considerations — though you are still ultimately relying on whichever underlying bridge the aggregator selects.
Be especially cautious with newer, unaudited bridges advertising unusually fast or cheap transfers. As with yield farming and other DeFi activities, unusually attractive terms often correlate with elevated underlying risk.
Common Crypto Bridge Use Cases
Accessing DeFi across chains. Moving capital to wherever the best yield opportunities exist, rather than being confined to a single blockchain’s DeFi ecosystem. Read our what is yield farming guide to understand what you might bridge assets toward.
NFT and gaming interoperability. Many blockchain games and NFT platforms operate on specific chains optimised for speed or low fees, requiring bridged assets for participation.
Layer 2 scaling. Moving assets between Ethereum’s mainnet and Layer 2 networks like Arbitrum or Base, which offer significantly lower transaction fees for everyday activity. For more on this relationship, read our what is Layer 2 guide.
Accessing chain-specific applications. Certain applications, particularly on Solana or newer chains, are not available on Ethereum and vice versa, making bridging necessary to participate.
FAQ
Is bridging crypto safe?
Bridging carries genuine, well-documented risk — over $2.8 billion has been lost to bridge hacks since 2022, representing approximately 40% of all Web3 exploits. However, using established, audited bridges with strong track records, sending test transactions first, and avoiding unusually new or unaudited protocols significantly reduces this risk, even though it cannot be eliminated entirely.
What is the difference between a bridge and a centralised exchange for moving assets?
A bridge moves assets directly between blockchains using smart contracts and validators, typically without requiring you to give up custody to a centralised company. A centralised exchange involves depositing assets with a company, which then credits you with assets on a different chain after you withdraw — introducing custodial risk but often avoiding certain bridge-specific smart contract risks.
Why do bridges get hacked more than other crypto infrastructure?
Bridges concentrate enormous value in single points (locked reserves), require trusting cross-chain information that is inherently difficult to verify with absolute certainty, and frequently rely on validator key systems that can be compromised. This combination of concentrated value and complex trust requirements makes bridges an unusually attractive target for sophisticated attackers, including state-sponsored groups.
What is a wrapped token?
A wrapped token is a synthetic representation of an asset from one blockchain, issued on a different blockchain through a lock-and-mint bridge. For example, Wrapped ETH (WETH) on a non-Ethereum chain represents ETH that has been locked on Ethereum, with an equivalent token minted elsewhere. Its value depends entirely on the bridge’s ability to honour redemptions.
Can I avoid bridge risk entirely?
Some newer architectures, like intent-based cross-chain swaps, reduce certain centralisation risks by avoiding large locked reserve pools. However, no current cross-chain solution eliminates risk entirely. Keeping assets on a single chain avoids bridge risk completely, but at the cost of losing access to opportunities on other chains.
What happened in the Ronin Bridge hack?
In March 2022, attackers linked to North Korea’s Lazarus Group compromised the private keys controlling the Ronin Bridge, which connected the Ronin side-chain (built for the Axie Infinity game) to Ethereum. This allowed them to authorise unauthorised transfers, resulting in the theft of over $500 million — the largest single bridge hack recorded to date.
Final Word
Crypto bridges solve a genuinely fundamental problem: blockchains are isolated by design, and a multi-chain ecosystem cannot function without some mechanism for moving value between them. That necessity has made bridges indispensable infrastructure for DeFi, gaming, NFTs, and virtually every cross-chain activity in crypto today.
However, that same necessity has made bridges the single most lucrative target for sophisticated attackers in the entire crypto ecosystem. The $2.8 billion lost since 2022, spanning incidents from Ronin to Kelp DAO, reflects a consistent pattern: concentrated value, complex trust assumptions, and validator infrastructure that remains difficult to secure perfectly.
The technology continues evolving — toward intent-based execution, trustless verification methods, and more carefully audited configurations. Until that evolution matures fully, the practical reality for any crypto user remains the same: bridging unlocks genuine value and flexibility, but it should be approached with the same caution you would apply to any high-value financial transaction involving infrastructure that has, repeatedly, proven exploitable.
Disclaimer: This article is for informational and educational purposes only and does not constitute financial advice. Cross-chain bridging carries significant security risk. Always research a bridge’s track record and conduct your own due diligence before transferring significant value.
