Cross-chain bridges are among the most important — and most dangerous — infrastructure in crypto. They move assets between blockchains that cannot natively communicate. Billions of dollars flow through bridges daily. Billions more have been stolen in bridge exploits. Understanding how bridges work, why they fail, and what safer alternatives exist is essential for anyone managing assets across multiple chains.
Why Bridges Exist
Different blockchains are isolated systems. Bitcoin cannot natively talk to Ethereum. Ethereum cannot natively talk to Solana. Yet users routinely want assets from one chain deployed on another: ETH collateral on an Avalanche lending protocol, BTC used in Ethereum DeFi, USDC moved from Ethereum to Polygon for lower fees.
Bridges solve this by locking assets on the source chain and issuing equivalent wrapped tokens on the destination chain. When you bridge USDC from Ethereum to Polygon, you lock real USDC in a bridge contract on Ethereum and receive synthetic USDC on Polygon. To exit, you burn the synthetic and unlock the original.
Types of Bridges
Lock-and-mint (custodial) — The original and most common design. Assets are locked in a smart contract on one chain; wrapped assets are minted on another. Risk: locked assets are a concentrated target. Wormhole, Ronin, and Multichain all suffered major exploits using this design.
Liquidity networks — Instead of wrapping, these maintain liquidity pools on each chain and perform atomic swaps. Connext, Hop Protocol, and Across use this model. Risk is distributed across multiple smaller pools rather than one large contract.
Native bridges — Chain-specific bridges built by the chains themselves (Ethereum-Optimism, Ethereum-Arbitrum). These often have 7-day withdrawal delays for optimistic rollups but are considered more trustworthy than third-party bridges.
Light client / ZK bridges — Emerging bridges using cryptographic proofs to verify source chain state, eliminating trusted relayers. IBC (Inter-Blockchain Communication) in the Cosmos ecosystem is the most successful live example.
The Bridge Exploit Track Record
Bridge security has been poor. Major exploits include:
- Ronin Bridge — $625M stolen (March 2022) via compromised validator keys
- Wormhole — $325M stolen (February 2022) via signature verification bypass
- Multichain — $130M+ missing (July 2023) amid the CEO's arrest
- Harmony Horizon Bridge — $100M stolen (June 2022) via compromised keys
The common thread: bridges concentrate large assets in contracts that bridge multiple security assumptions simultaneously.
Safer Patterns for Cross-Chain Activity
Use native bridges for large amounts — Accept the 7-day delay on optimistic rollup withdrawals in exchange for canonical bridge security. Do not bridge $500K through a third-party bridge to save one day.
Prefer liquidity networks over lock-and-mint — Hop, Across, and Connext have better security profiles for smaller transfers.
Check bridge TVL and audit status — Smaller TVL bridges have not been tested under real attack conditions.
Consider non-bridge alternatives — For moving between major chains, swapping through a centralized exchange (deposit on chain A, withdraw on chain B) avoids bridge risk entirely. Non-custodial services like SyntheticSwap can also route swaps across chains without users managing bridges directly.
The Interoperability Vision
Long-term, the industry is moving toward more trustless interoperability. The IBC protocol, used by Cosmos chains, demonstrates that safe inter-chain communication is possible when chains share compatible consensus designs. ZK bridges, once mature, will enable chains to verify each other's state cryptographically rather than relying on trusted validators.
Until then, bridges remain a necessary but risky part of the multi-chain ecosystem. Using them carefully — with size limits, preference for audited systems, and awareness of risks — is as important as any other security practice.
