What Is a Crypto Bridge and Why Are They a Target?

To understand why bridges fail in the ways they do, it helps to understand what they are actually doing.

Each blockchain is its own separate ledger. Ethereum does not know what is happening on Solana. Solana does not know what is happening on Arbitrum. When you want to move an asset from one chain to another, there is no native mechanism to do it. The two ledgers cannot communicate directly.

A bridge solves this by creating a representation of an asset on the destination chain. The most common mechanism works like this: you deposit an asset on Chain A, the bridge locks it, and a corresponding wrapped version of that asset is minted on Chain B. To get your original asset back, you burn the wrapped version, and the bridge unlocks the original on Chain A.

For this to work, the bridge needs a way to verify that the deposit on Chain A actually happened before it mints on Chain B. That verification mechanism is where most exploits occur.

Different bridges use different verification mechanisms, and each carries its own risks.

Some bridges rely on a set of validators or multisig signers who must confirm transactions. If those signers are compromised, the attacker can authorize fraudulent transactions. The Ronin Bridge hack in March 2022 worked this way. The Ronin network used nine validator nodes to confirm bridge transactions. An attacker associated with North Korea's Lazarus Group compromised five of those nine nodes, giving them enough control to authorize withdrawals of approximately 173,600 ETH and 25.5 million USDC. The bridge had no on-chain mechanism to detect that the majority of its validators had been compromised. The theft went undetected for six days.

Other bridges rely on a single trusted entity to relay messages between chains. This creates a centralization point: if that entity is compromised or behaves dishonestly, the bridge has no check on their actions.

The Kelp DAO attack in April 2026 targeted a different layer. The bridge used a single verification node to confirm cross-chain messages. Attackers compromised the infrastructure feeding data to that node, sent fraudulent verification data, and caused the bridge to release 116,500 rsETH tokens to attacker-controlled addresses. The on-chain contracts performed correctly. The data they relied on was false. The entire attack sequence unfolded in under an hour before the bridge was paused.

Some bridges use optimistic verification, which assumes transactions are valid by default and relies on challengers to flag invalid ones within a challenge window. This approach reduces cost and complexity, but it means fraudulent transactions can be finalized if no one catches them in time.

Even a bridge with strong verification mechanisms concentrates risk in a specific way: the locked assets.

When you deposit 10,000 ETH into a bridge to move it to another chain, all 10,000 ETH sits in the same smart contract on the origin chain. As bridges grow more popular and lock more value, that contract becomes a larger target. An attacker who finds a single vulnerability in the bridge contract, or who compromises enough of the verification infrastructure, gains access to all of it at once.

This is fundamentally different from the risk of holding assets in your own wallet. Your wallet holds only what you put there. A bridge smart contract may hold hundreds of millions of dollars deposited by thousands of users. A single successful attack can drain all of it.

The Wormhole bridge hack in February 2022 exploited a signature verification flaw that allowed an attacker to mint 120,000 wrapped ETH on Solana without depositing any ETH on Ethereum. The value of the minted tokens was approximately $320 million. The flaw was a few lines of code in the signature validation logic.

Most users who interact with bridges are doing so to access a DeFi protocol or application on a different chain, often because fees are lower or because a specific protocol only exists on that chain. The bridge interaction itself may take seconds and feel routine.

What changes in the background is your risk exposure. The assets you bridged are now wrapped versions of the original. Their value depends on the bridge maintaining its peg and its locked reserves remaining intact. If the bridge is exploited after you cross, the wrapped version you hold may lose its value or become unexchangeable. Your assets are safe on their new chain. The problem is the bridge can no longer give you back the originals.

After the Kelp DAO exploit, the stolen rsETH was deposited as collateral on Aave, which triggered a cascading liquidity crisis across multiple DeFi protocols. Users who had never interacted with Kelp DAO still found their positions affected. This is the interconnected nature of DeFi: bridge failures do not stay contained to the bridge.

Using a bridge means trusting an additional system with your assets, even temporarily. A few things are worth understanding before doing so.

How does the bridge verify transactions? A bridge that relies on a small number of validators is different from one that uses a cryptographic proof system. The fewer the trusted parties, the more concentrated the risk.

How long has the bridge been operating, and what is its security track record? Bridge code is complex and difficult to audit thoroughly. Newer bridges with limited track records carry uncertainty that established ones may not.

Where are the bridged assets while in transit? Understanding whether assets are locked in a smart contract, held by a custodian, or handled by another mechanism clarifies what you are trusting and what could go wrong.

Bridges are infrastructure. Most users do not think about them any more than they think about the server infrastructure behind a website. But in crypto, infrastructure failures translate directly into asset losses, and bridge failures have been some of the largest in the industry's history.

Understanding what a bridge does and how it works can help you understand the risks you may face when using one.