A crypto bridge moves value from one blockchain to another — say, bringing ETH from Ethereum onto a layer 2 or onto Solana. Because a coin can't literally leave its home chain, a bridge usually locks the asset on the source chain and mints a matching token on the destination, then reverses that when you come back. The place where those locked assets pile up is exactly why bridges have been among the most hacked things in crypto.
Why bridges are needed
There is no single blockchain. Assets and apps are spread across Ethereum, its many layer 2s, and other chains like Solana or Avalanche, and these networks can't natively talk to each other. A bridge is the connector that lets you use funds from one chain on another — to chase lower fees, reach an app that only exists elsewhere, or move liquidity where it's needed.
How a lock-and-mint bridge works
The most common design is lock-and-mint:
- Lock. You deposit, say, 1 ETH into the bridge's contract on Ethereum. It's held there.
- Verify. The bridge's validators or relayers confirm the deposit really happened.
- Mint. The bridge issues 1 "bridged ETH" on the destination chain, a token that represents a claim on the locked ETH.
- Use. You spend or trade that bridged token on the new chain.
- Burn and unlock. To return, you burn the bridged token; the bridge then releases your original ETH on Ethereum.
The bridged token is only as good as the assets locked behind it. If those are stolen, the bridged token becomes a claim on nothing.
Who verifies the move? Two models
| Model | How transfers are approved | Trust assumption |
|---|---|---|
| Trusted / external validators | A set of operators (sometimes a multi-sig) watch both chains and sign off | You trust that group not to collude or get compromised |
| Trust-minimised / native | The chains verify each other cryptographically (light clients, validity proofs) | Trust is mostly in the code and the chains themselves |
Many fast, popular bridges lean on the trusted model because it's simpler and cheaper to build. That convenience is also the weak point.
Why bridges get hacked
Bridges concentrate enormous value in one place and depend on everything — contracts, validators, keys — being flawless. Common failure modes:
- Private-key compromise. If an attacker gets enough of the validators' signing keys, they can authorise fake withdrawals. The Ronin bridge lost around $600M in 2022 this way, after attackers controlled a majority of its validator keys.
- Smart-contract bugs. A flaw in the lock/mint logic can let someone mint tokens that were never backed. The Wormhole bridge was exploited for about $320M in 2022 when a signature-verification bug let an attacker mint unbacked tokens.
- Fake deposit proofs. If the verification step can be tricked into believing a deposit happened, the bridge mints tokens for free.
- Centralised control. Multi-sigs with too few signers, or upgrade keys held by a small team, are single points of failure.
Because the locked pool is a giant honeypot, a single mistake can be catastrophic — bridges have accounted for some of the largest hacks in crypto history.
How to reduce your risk
- Prefer official or native bridges (for example a rollup's own bridge) over unknown third parties.
- Favour trust-minimised designs that rely on cryptographic verification rather than a small operator set.
- Don't leave value in bridged form longer than you need to.
- Check track record and audits, and be wary of brand-new bridges offering unusually high incentives.
- Move smaller amounts, and understand that a bridged token's value depends entirely on the bridge staying solvent.
This is a fast-moving area, and bridge designs and security keep improving, so treat the examples here as history and check a bridge's current status before using it.
Key takeaways
- A bridge moves value between blockchains, usually by locking an asset on one chain and minting a representation on another.
- The bridged token is a claim on the locked assets — worthless if those assets are stolen.
- Transfers are approved either by trusted validators or by trust-minimised cryptographic verification.
- Bridges get hacked because they concentrate value and depend on flawless keys, contracts and proofs.
- Real cases include Ronin (
$600M, key compromise) and Wormhole ($320M, contract bug). - Reduce risk with official, trust-minimised bridges, short exposure, and caution toward new, high-incentive ones.
Get the weekly commit
New blockchain deep dives every week.
