A cross-chain bridge is a protocol that moves value between separate blockchains, and because most designs concentrate large amounts of locked collateral in a single smart contract or validator set, bridges have become one of the most frequently exploited targets in crypto.
Why cross-chain bridges are high-value targets
Bridges connect blockchains that run entirely different consensus rules, so most of them work by locking a native asset in a central smart contract vault on chain A and minting a wrapped representation of that asset on chain B. These central lockup vaults can hold hundreds of millions of dollars in collateral at any given time, which makes them an unusually concentrated and attractive target for sophisticated attackers.
Anatomy of bridge security architectures
Federated multisig bridges rely on a small set of validator nodes to approve every cross-chain transfer. If attackers manage to compromise a quorum of those validators' private keys, as happened in the Ronin and Harmony bridge hacks, they can forge withdrawal approvals and drain the vault without needing to break any cryptography at all. Optimistic and zero-knowledge bridges take a different approach, using cryptographic validity proofs or fraud-challenge windows to verify cross-chain state transitions without needing to trust a centralized validator set, which gives them meaningfully stronger security guarantees at the cost of some added complexity or settlement delay.
Safety guidelines for capital transfers
- Prefer native burn-and-mint transfer protocols, such as Circle's Cross-Chain Transfer Protocol, over wrapped token bridges wherever the asset supports it, since burning and reminting the native asset avoids the wrapped-token depeg risk entirely.
- Never leave idle capital sitting in wrapped derivative assets on a non-native chain for extended periods, since every day it sits there is another day of exposure to whichever bridge issued it.