Crypto Bridges Explained: Cross-Chain Transfers and Their Risks

A crypto bridge moves assets between blockchains that cannot natively talk to each other. Bridges are essential infrastructure for a multi-chain ecosystem, but they are also the single most attacked surface in crypto. Understanding how they work — and where they break — is important before using one.

Why bridges exist

Each blockchain is its own isolated ledger. Bitcoin cannot verify what is happening on Ethereum. Ethereum cannot natively read Solana's state. Yet users want to move value between chains — to access a DeFi protocol that only exists on one chain, to use a faster and cheaper network for certain operations, or to take advantage of yield opportunities on a different Layer 2.

Bridges are the protocols that make this possible by maintaining synchronized state across two chains: they accept an asset on one chain and issue a claim on it on another.

The lock-and-mint model

The most common bridge architecture works like this:

1. You deposit an asset (say, USDC) into the bridge's smart contract on the source chain. The asset is now locked there.
2. The bridge's validator network (or oracle system) detects this deposit.
3. The bridge mints a wrapped version of USDC on the destination chain and delivers it to your address there.

To reverse the process (bridge back), you send the wrapped token to the bridge contract on the destination chain — it is burned — and the original is unlocked and returned to you on the source chain.

The locked pool on the source chain is the critical point: it holds all the original assets backing every wrapped token in circulation. At peak usage, major bridges hold hundreds of millions to billions of dollars in locked assets. This concentration is what makes bridges attractive targets.

Trust assumptions

Every bridge answers the question: who decides a deposit on chain A is valid before minting on chain B? The answer defines the bridge's trust model:

• Multisig validators: a set of entities (often 5-of-9 or similar) must collectively sign off on each message. Security is as strong as the weakest signer and the access controls around their keys. This is how the Ronin bridge worked — and five of nine validators were compromised.
• Light client bridges: the destination chain runs a lightweight version of the source chain's consensus, cryptographically verifying block headers. Much more secure, but computationally expensive and complex to implement.
• Optimistic bridges: transactions are assumed valid unless challenged within a dispute window (often 7 days). Fast in practice, but requires at least one honest watcher.
• ZK bridges: use zero-knowledge proofs to cryptographically prove source-chain state without running a full validator set. Highest security, but computationally intensive and still maturing as a technology.

Major bridge hacks

Bridge hacks account for the largest single-incident losses in crypto history:

• Ronin Network — $625 million (March 2022): The bridge for the Axie Infinity game used a 5-of-9 multisig. Attackers — later attributed to North Korea's Lazarus Group — compromised five validator private keys through social engineering and a malicious job offer. With five keys, they authorized fraudulent withdrawals of 173,600 ETH and 25.5 million USDC. The theft went undetected for six days.
• Wormhole — $320 million (February 2022): A vulnerability in the Wormhole bridge's Solana-side contract allowed the attacker to forge a valid guardian signature without actually having one. They used the forged signature to mint 120,000 wrapped ETH on Solana with no corresponding deposit. Jump Crypto, a backer of Wormhole, replenished the funds to make users whole.
• Nomad Bridge — $190 million (August 2022): A flawed initialization allowed any message to be processed as if it had been pre-approved. Once the first attacker found this, hundreds of copycat wallets drained the bridge opportunistically within hours.

Native bridges vs third-party bridges

Not all bridges carry the same risk profile. When you move assets to a Layer 2 like Arbitrum or Optimism using their official bridge, you are using a bridge that inherits Ethereum's security guarantees. Fraud proofs (optimistic rollups) or validity proofs (ZK rollups) mean the bridge's correctness is verified cryptographically rather than trusted to a validator committee.

Third-party cross-chain bridges — moving assets between unrelated Layer 1 networks like Ethereum and Solana — have no shared security model to fall back on. They rely entirely on their own validator set and smart contract security.

Risk reduction practices

Bridge risk cannot be eliminated, but it can be managed:

• Use official native bridges when possible (Arbitrum Bridge, Optimism Bridge, Base Bridge)
• Prefer bridges with long operating histories, multiple audits, and active bug bounty programs
• Do not leave large amounts sitting in bridged (wrapped) tokens longer than necessary
• For large amounts, consider bridging in stages rather than all at once
• Check that the bridge you are using is the officially endorsed one for that network — phishing sites impersonating bridges are common

Bridge resources on ChainClarity

• Layer 2 — rollup networks with cryptographically secured official bridges
• DeFi — the protocols that make cross-chain bridging economically useful
• Smart contracts — the code underpinning bridge lock-and-mint mechanics
• Blockchain — the isolated systems that bridges connect
• Ethereum — the source chain for most major cross-chain bridge volume