The cryptocurrency ecosystem is not a single blockchain — it is hundreds of independent networks. Ethereum, Solana, BNB Chain, Avalanche, Polygon, and dozens of others all operate in isolation by default. Blockchain bridges are the infrastructure that connects them, enabling assets and data to move between chains. They are also, historically, the most exploited infrastructure in all of DeFi.
Why Bridges Are Necessary
Different blockchains are optimised for different things. You might want to use Ethereum’s mature DeFi ecosystem for lending but Solana’s speed and cheap fees for trading. Or you might have assets on Ethereum but want to interact with a protocol on Avalanche. Without bridges, assets are siloed on their native chain.
How Bridges Work
Most bridges use a lock-and-mint model:
- You deposit ETH into a bridge smart contract on Ethereum. The ETH is locked.
- The bridge’s validators or smart contracts verify the deposit.
- An equivalent amount of wrapped ETH (WETH) is minted on the destination chain (e.g., BNB Chain).
- When you bridge back, the WETH is burned and your original ETH is unlocked on Ethereum.
The wrapped token represents a claim on the locked original. The security of that claim depends entirely on the security of the bridge’s smart contracts and validator set.
Types of Bridges
Trusted / Centralised Bridges
Operated by a company or a small group. Faster and simpler, but requires trusting the operator. Examples: Binance Bridge (centralised exchanges), WBTC (custodian: BitGo). If the operator is hacked or acts maliciously, locked funds are at risk.
Trust-Minimised / Decentralised Bridges
Use validators, multisig, or cryptographic proofs to secure the bridge. Examples: Wormhole (validators), Multichain (validators), Synapse (liquidity network), Across Protocol.
Native / Canonical Bridges
Official bridges from Layer 2 rollups to Ethereum: Arbitrum Bridge, Optimism Bridge, zkSync Bridge. These inherit Ethereum’s security but have withdrawal delays of 7 days (for Optimistic Rollups). The safest option for moving between Ethereum and its L2s.
Liquidity-Based Bridges (Atomic Swaps)
Instead of locking and minting, these bridges match buyers and sellers across chains using liquidity pools. Examples: Stargate (LayerZero), Hop Protocol, Connext. Generally safer since there is no large honeypot of locked assets.
The Bridge Hack Problem
Bridge contracts hold enormous amounts of locked assets — making them the biggest honeypots in DeFi. The consequences of vulnerabilities are catastrophic:
- Ronin Bridge (March 2022): $625M stolen. Axie Infinity’s bridge was secured by only 9 validators; attackers compromised 5 private keys.
- Wormhole (February 2022): $320M stolen. A bug in the signature verification allowed an attacker to mint 120,000 wETH without depositing collateral.
- Nomad Bridge (August 2022): $190M stolen in a chaotic free-for-all. A misconfiguration allowed any message to be accepted as valid, enabling hundreds of copycats to drain the bridge.
- Multichain (July 2023): $130M+ drained, allegedly by an insider. The bridge then shut down entirely, leaving users with worthless wrapped tokens.
In total, over $2.5 billion was stolen from bridge exploits between 2021 and 2023 alone.
How to Use Bridges More Safely
- Prefer canonical/native bridges for Ethereum L2s (Arbitrum, Optimism bridges) — they have no smart contract risk between chains
- Use established protocols with years of operation and multiple audits. Newer bridges are higher risk.
- Do not leave funds in bridge contracts. Bridge, then immediately use or store your assets elsewhere.
- Verify the bridge address — phishing sites clone bridge UIs. Always use official links.
- Avoid bridges holding hundreds of millions of dollars. The larger the locked value, the more incentive for attackers.
- Check audit status on DefiLlama’s bridge page and the project’s documentation.
The Future: Zero-Knowledge Proof Bridges
Next-generation bridges are using zero-knowledge proofs to verify on-chain state from one chain on another, without trusting any intermediary validators. Projects like zkBridge, Succinct Labs, and Polymer are building this infrastructure. ZK bridges are slower and more computationally expensive today, but they represent the most secure design possible — mathematical proof replaces validator trust.
Conclusion
Bridges are essential infrastructure for a multi-chain world, but they are also its greatest attack surface. The history of bridge exploits is a masterclass in why “decentralised” systems are only as secure as their weakest link. When bridging assets, prioritise security over convenience, use the most battle-tested protocols available, and minimise the time your assets spend in bridge contracts.