Why Cross-Chain Bridges Get Hacked (and How to Bridge Safer)

What a cross-chain bridge actually does

Blockchains can't see each other. Ethereum has no idea what's happening on Solana, and Solana can't read Ethereum. So when you "move" ETH to another chain, nothing moves.

Most bridges work by lock and mint. You send your coins into the bridge's contract on chain A, where they get locked. The bridge then creates a matching IOU on chain B, called a wrapped token. When you want out, you burn the IOU on chain B and the bridge releases the original coins on chain A.

That's the whole trick. And it's also the weakness. Every wrapped token on chain B is only worth something because real coins sit locked on chain A. Those locked coins pile up into one of the biggest single targets in crypto. Chainalysis put it bluntly in its August 2022 analysis: bridges hold a central store of funds backing the bridged assets, and that store is the target.

Why bridges get hacked: the three ways in

Bridge hacks look different on the surface. Underneath, nearly all of them come down to tricking the middle box in the diagram above.

1. Stolen keys. Many bridges let a small group of validators sign off on withdrawals. Get enough of their keys and you can sign a withdrawal for everything. That's how Ronin, the bridge behind the game Axie Infinity, lost about $620 million in March 2022. The FBI said in April 2022 that North Korea's Lazarus Group and APT38 were responsible. Harmony's Horizon bridge went the same way in June 2022: about $100 million gone, and only two signatures needed to move it. The FBI confirmed in January 2023 that the same North Korean groups were behind it.

2. Forged messages. Some bridges check a signature or proof before minting on the other side. If the check is broken, an attacker can mint wrapped tokens out of thin air and redeem them for real coins. Wormhole lost about $320 million in February 2022 because a signature check in its Solana code didn't actually verify signatures, as The Register reported at the time.

3. Bad code or bad config. Nomad lost about $190.7 million in August 2022 after its trusted root was set to zero, which made every message look valid. Once the first attacker went in, dozens of addresses copied the transaction, swapped in their own wallet and hit send. The Register called it crowd looting. No coding skill required.

It hasn't stopped. On 18 May 2026 the Verus-Ethereum bridge lost about $11.58 million, according to The Defiant citing the security firm Blockaid. Early reports pointed to a faked cross-chain transfer message, the same family of flaw as Wormhole.

Are bridge hacks the biggest crypto heists?

Some of the biggest, yes. The biggest ever, no. The record belongs to the Bybit exchange hack of February 2025, roughly $1.5 billion, which the FBI attributed to North Korea in a public service announcement on 26 February 2025. The blockchain analytics firm Elliptic called it the largest crypto theft on record.

Bridges still crowd the top of the list. In 2022 they were the main event. Chainalysis estimated that North Korea-linked hackers had stolen about $1 billion that year by August, all of it from bridges and other DeFi protocols.

The risk you're more likely to meet

You can't stop a validator getting phished in another country. What you can stop is the stuff aimed at you. Bridging is fiddly, people search for it in a hurry, and that makes it good bait.

Fake bridge sites copy the real one pixel for pixel and buy ads above it in search. You connect your wallet, press "Bridge", and the pop-up you sign is an approval that hands over your tokens. Same move as most wallet drainers, just dressed up as a bridge.

Prefer to watch? Why bridges get hacked and what to check, in under a minute.

How to bridge safer: 5 checks before you bridge

None of this makes bridging risk-free. It does take you out of the easy-target pile.

1. Get the address from the docs, never from an ad. Open the chain's or project's official documentation and follow its link to the bridge. Bookmark it. Skip sponsored search results entirely.
2. For big amounts, use the chain's own bridge. Most layer-2 networks run an official (canonical) bridge to Ethereum. It can be slower, sometimes days to withdraw, but it leans on the chain's own security instead of a separate set of keys.
3. Look up the bridge's track record. L2BEAT publishes risk notes on how bridges and layer-2s are secured, including who holds the keys. DefiLlama and rekt.news list past hacks. A bridge with a hack history and no clear fix is a pass.
4. Send a small amount first. Bridge a test amount, confirm it lands on the other chain, then send the rest. It costs one extra fee and catches wrong networks, wrong addresses and fake sites.
5. Revoke the approval after. Bridging tokens usually means approving the bridge contract to spend them. When you're done, check your approvals on the chain's block explorer and revoke any you don't need. An old approval to a bridge that later gets hacked is an open door.

Then think about how long the wrapped token sits there. Every day you hold a wrapped coin, you're trusting that bridge's pot to stay full. If you're holding for months, ask whether you need to be on that chain at all, and where your keys live. Our guide to hot wallet vs cold wallet covers that side.

Not sure whether a site, a message or an offer is a scam? Our is this a scam? quiz takes a minute, and the Scams hub has every guide in one place.

What to do if a bridge you used gets hacked

• Revoke any approval to that bridge now. If the contract is compromised, a live approval lets it take more.
• Stay off social media "refund" links. Fake claim and compensation sites show up within hours of every big hack. Only trust updates linked from the project's official, long-standing channels.
• Report losses to the FBI at ic3.gov. Include transaction IDs and wallet addresses.
• Ignore anyone offering to recover your funds for a fee. That's the next scam.

Before you put money into any protocol, bridge or pool, run it through our crypto due diligence checklist, read is DeFi safe? for the wider risks, and see how liquidity pools work if your bridged coins are headed into one.

FAQ

Is bridging crypto safe?

No bridge is risk-free. Your coins depend on the bridge's keys and code staying secure, and Chainalysis counted about $2 billion stolen across 13 bridge hacks by August 2022. You can lower your risk by using official links, the chain's own bridge for large amounts, and a small test transfer first.

What is the safest type of bridge?

For moving funds between Ethereum and a layer-2 network, the chain's own canonical bridge is usually the lowest-risk route because it relies on the chain's own security. Third-party bridges that depend on a small group of signers have been hit hard, including Ronin and Harmony. Check a bridge's risk notes on L2BEAT before you use it.

What happens to my wrapped tokens if a bridge is hacked?

A wrapped token is an IOU backed by coins locked in the bridge. If those coins are stolen, the IOU can lose its backing and trade far below the original, or become hard to redeem at all. Whether holders get made whole depends on the project, and nobody is obliged to do it.

How do I spot a fake bridge site?

Fake bridge sites usually arrive through search ads, DMs or social media replies, and they copy the real design. Get the bridge link from the chain's or project's official docs and bookmark it. If a site asks for your seed phrase, close it.

Do I need to revoke approvals after bridging?

It's a good habit. Bridging tokens often means approving the bridge contract to spend them, and that approval can stay live long after you're done. Revoke approvals you no longer need on your chain's block explorer so a later hack or fake contract can't use them.

Are bridge hacks the biggest crypto thefts?

Several rank near the top of the list. The Ronin bridge lost about $620 million in 2022, while the largest theft on record is the roughly $1.5 billion Bybit exchange hack in February 2025, which the FBI attributed to North Korea.