Crypto Bridge Hacks Explained: How Bridges Fail

Cross-chain bridges get hacked because most of them hold a large pool of locked coins on one chain and release them when a small set of signers or a piece of verification code says a matching event happened on another chain. Break the signers or the code and the whole pool is exposed. Chainalysis estimated in August 2022 that about 2 billion dollars had been stolen in 13 bridge hacks that year, 69 percent of all crypto stolen up to then.

The three largest bridge failures of that period each broke a different link: compromised validator keys at Ronin, a signature-verification bug at Wormhole, and a faulty contract upgrade at Nomad. Understanding which link failed is more useful than memorizing the dollar figures, because it tells you what to check before you move money across any bridge. This guide explains how bridges work, reconstructs those three incidents from the published post-incident analyses and official statements, sorts bridge risk into a small number of failure modes, and ends with a checklist you can apply to any bridge without trusting its marketing.

What a Bridge Actually Does

Blockchains cannot read each other's state directly. A bridge is a system that watches one chain and acts on another. The Ethereum developer documentation describes three basic mechanisms:

Lock and mint is the one that creates the honeypot. The locked pool on the source chain backs every wrapped token on the destination chain. If an attacker can withdraw from that pool without burning the wrapped tokens, or mint wrapped tokens without locking anything, the wrapped tokens become claims on a pool that no longer holds enough. Chainalysis made the same point in its 2022 analysis: bridges often feature a central storage point of funds, and that storage point becomes a target.

Trusted versus trust-minimized

The same documentation splits bridges by who verifies cross-chain events:

Neither model is safe by default. Trusted bridges fail when keys are stolen or operators collude. Trust-minimized bridges fail when the verification code has a bug. The incidents below include one of each, plus a failure that sits in the gap between: a routine upgrade that broke verification entirely.

Three Incidents, Three Different Failures

All sources checked October 21, 2026. Dollar values are as reported at the time and depend on the prices used.

Ronin: the keys were the bridge

Ronin's bridge was a trusted design. Withdrawals needed approval from a set of validators. According to the developers' account reported by ForkLog in April 2022, Sky Mavis controlled four of the nine validators. A phishing attack on a Sky Mavis employee gave the attacker access to company infrastructure. Separately, Sky Mavis had earlier been allowed to sign on behalf of the Axie DAO validator, and that access was not revoked after the arrangement ended in December 2021. With those keys, the attacker could approve withdrawals that looked legitimate to the bridge contract. The US Treasury later attributed the theft to the Lazarus Group, linked to North Korea, and described it as worth almost 620 million dollars.

The lesson is that a multisig is only as strong as the independence of its signers. Nine validators, four held by one company and a fifth delegated to that same company, behaved like one point of failure.

Wormhole: the check that did not check

Wormhole's guardians sign messages that authorize minting on the destination chain. CertiK's analysis describes how, on February 2, 2022 at 17:58 UTC, the attacker passed a fake system account into the Solana program's signature-verification step. The program relied on a deprecated function that did not confirm the account it was reading was the genuine system account, so the forged input made unverified signatures look verified. The attacker then minted 120,000 wETH on Solana without depositing anything, and moved part of it back to Ethereum. Jump Trading, Wormhole's parent company, said on February 3 that it would replace the missing ETH.

The lesson is that the guardians' keys were never stolen. The code that was supposed to check their signatures was fooled. A bridge with honest operators can still fail through its verification logic.

Nomad: the upgrade that let everyone through

Nomad used an optimistic design in which messages are accepted against a trusted root. Halborn's analysis, citing Nomad's own post-mortem, traces the failure to a June 21, 2022 upgrade to the Replica contract that set the trusted root to zero during initialization. Zero was also the default value for an unproven message, so every message counted as proven. Once one exploit transaction appeared on August 1, others copied it by swapping in their own addresses. Halborn counts 960 transactions and 1,175 withdrawals, with the bridge's value falling from about 190.7 million dollars to 1,794 dollars within hours.

The lesson is that upgrades are part of the attack surface. A bridge audited at launch can become unsafe after a routine change, and the change in this case sat unnoticed for about six weeks.

The Failure Modes, Sorted

Most bridge losses fall into a handful of categories. Here is how the three incidents map, plus the other common categories the Ethereum documentation lists.

The fourth row is easy to overlook. When a bridge pool is drained, the damage does not stay with people who used the bridge. Wrapped tokens may be posted as collateral in lending markets, paired in liquidity pools, or held by funds. If the wrapped token loses its backing, every protocol that accepted it inherits the loss.

Worked Example: What a Wrapped Token Is Worth After a Drain

An illustration with round numbers, not any real bridge. A bridge has locked 100,000 ETH on Ethereum and minted 100,000 wrapped ETH on another chain. An attacker withdraws 60,000 ETH from the lock contract without burning anything.

If nobody steps in, each wrapped token is now a claim on 0.40 ETH, and holders will rush to redeem first. That race is why bridges usually pause after an exploit, and why the outcome for holders often depends on whether someone, such as the project's backers, replaces the missing funds. In the Wormhole case, the parent company did. In other cases, nobody has. You cannot know in advance which kind of bridge you are using.

The same arithmetic runs the other way when an attacker mints without depositing, as at Wormhole. The lock contract still holds everything it held, but there are more wrapped tokens than locked coins, so the backing per token falls in exactly the same way.

Scoring a Bridge: A Simple Framework

The checklist above produces a lot of yes and no answers. To compare two bridges, it helps to turn the most important ones into a rough score. This is a CryptosEyes framework for organizing your own reading, not a rating of any real bridge, and the weights are a judgment call you can change.

A bridge scoring 8 to 10 has addressed the main failure modes on paper. One scoring 4 or less is asking for a lot of trust. Even a high score is not a guarantee: Wormhole's guardians were not compromised, and its loss came from a code path an audit could have missed. Use the score to decide how much to send and how long to leave it, not whether a bridge is safe.

Applying the framework to the three incidents

Working backward from the published accounts:

Why Rate Limits Matter So Much

Of all the controls, withdrawal limits are the one that changes the size of a disaster rather than its likelihood. Suppose a bridge holds 200 million dollars and caps total outflows at 10 million dollars per day, and an attacker finds a way to withdraw without authorization. Without the cap, the pool can be emptied in a few transactions, as at Nomad, where Halborn describes value falling from about 190.7 million dollars to 1,794 dollars within hours. With the cap, the attacker can take at most 10 million dollars before the next day's window, which gives operators time to notice and pause the bridge.

The trade-off is convenience. Rate limits mean large legitimate transfers may have to wait or be split up. For most users that is a good trade. When a bridge advertises instant, unlimited transfers, ask what stops an attacker from making the same instant, unlimited transfer.

The Bigger Picture in 2025 and 2026

Bridges also matter after a theft happens elsewhere. Chainalysis's December 18, 2025 report on stolen funds estimated more than 3.4 billion dollars stolen from January through early December 2025, of which the February compromise of the exchange Bybit accounted for 1.5 billion. It attributed at least 2.02 billion dollars of 2025 thefts to North Korea-linked hackers and described their heavy reliance on cross-chain bridges to move assets between chains and complicate tracing.

So a bridge can be a victim, as in 2022, or a route, as in Chainalysis's 2025 description. For an ordinary user, the second role mostly matters because bridges that handle stolen funds can face freezes, sanctions exposure or sudden shutdowns. That is a counterparty risk on top of the technical ones.

A Due-Diligence Checklist Before You Bridge

Apply this to any bridge. None of it requires trusting the bridge's own description of itself, only reading its documentation, contracts and public records.

Common Mistakes

Frequently Asked Questions

Are crypto bridges safe?

No bridge is risk-free. Each one adds at least one new way to lose funds: its signers, its code, or its upgrade process. Some designs reduce particular risks, such as rate limits and time-delayed upgrades, but the history of 2022, when Chainalysis counted about 2 billion dollars stolen from bridges by August, shows that large, well-known bridges have failed. Use bridges only when you need to, and size your exposure accordingly.

What was the biggest bridge hack?

Among bridge incidents, the March 2022 Ronin theft is usually cited as the largest. The US Treasury described it as worth almost 620 million dollars. It was a key compromise: attackers gained control of enough validator signing keys to approve fraudulent withdrawals.

What is a wrapped token?

A wrapped token represents an asset from another chain. With a lock-and-mint bridge, the original asset is held in a contract on its home chain and a matching token is minted on the destination chain. The wrapped token is worth the original only as long as the locked pool fully backs it and can be redeemed.

How do I know if a bridge is trusted or trust-minimized?

Read its documentation for how cross-chain messages are verified. If a named group of operators or a multisig signs off on transfers, it is a trusted design. If the destination chain verifies proofs of the source chain's state on its own, it is trust-minimized. Many bridges mix elements of both, so look at who can actually approve a withdrawal.

Can stolen bridge funds be recovered?

Sometimes, in part. After the Nomad exploit, Halborn reported that over 33 million dollars had been returned to Nomad's wallet by white-hat hackers as of August 15, 2022, out of about 190 million dollars drained. In the Wormhole case, the parent company replaced the missing ETH. Neither outcome is guaranteed, and law-enforcement recovery, where it happens, can take years.

Is moving funds between Ethereum and a layer 2 the same risk?

The risks overlap but are not identical. A rollup's own bridge to Ethereum is part of the rollup's contracts, so its safety depends on how the rollup proves its state to Ethereum and on who can upgrade those contracts. Third-party bridges between the same two chains add their own operators and code on top. Our layer 1 vs. layer 2 guide explains how rollups settle to Ethereum, which is the starting point for judging their bridges.

Do bridge hacks affect people who never used the bridge?

They can. If a drained bridge's wrapped token is used as collateral in lending protocols or held in liquidity pools, those protocols and their users can take losses when the wrapped token loses its backing.

Related Reading

Bridges are not the only contracts that can reach your tokens. Every approval you grant a bridge or swap stays live until you cancel it, and the token approvals guide shows how to list and revoke them after a protocol you used is exploited.

Bridge risk is one form of a broader question: who actually holds the assets behind a token you own. Our stablecoin proof-of-reserves checklist applies the same "check the backing, not the label" approach to stablecoins, and the exchange reserve risk checklist does it for centralized platforms. For the fake "recovery services" that follow every bridge incident, the scam section of our wallet recovery checklist lists the warning signs, and for the structure of base chains and rollups that bridges connect, see layer 1 vs. layer 2. More security research is in the CryptosEyes research library.

CryptosEyes publishes educational research, not financial or security advice. We do not recommend any bridge, token or platform. Bridged and wrapped assets can lose all their value, and losses are often not recoverable.