A crypto bridge is the plumbing that lets a token move from one blockchain to another. Bitcoin cannot see Ethereum. Ethereum has no idea what happens on Solana. Each chain keeps its own ledger and holds no built-in way to check what occurred somewhere else. A crypto bridge is the workaround, and over the past decade it has quietly become the single most attacked piece of infrastructure in the market.
The reason to care is simple. If you have ever moved USDC from Ethereum to a cheaper chain to save on fees, or shifted funds onto a layer 2 to use an app, you have used a bridge whether you noticed it or not. Understanding what happens in that moment is the difference between an informed transfer and a blind one.
Blockchains cannot talk to each other on their own
Picture two banks that will never share a wire system, never answer each other's phone calls, and never accept a letter from the other side. That is the default relationship between any two blockchains. A validator on Ethereum has no way to confirm that you burned a token on Avalanche, because it cannot read Avalanche's records. There is no shared clock and no shared truth.
This isolation is deliberate. Each chain guards its own security by only trusting its own validators and its own history. The tradeoff is that value gets stuck. Your token is native to the chain it was minted on and, left alone, it stays there forever.
A bridge builds an artificial connection across that gap. It watches one chain, records what you did, and makes something happen on the other. The trouble is that this connection has to be trusted by both sides, and trust is exactly the thing a public blockchain was designed to remove. Every bridge reintroduces a middleman, and the middleman is where the money sits.
The three ways a crypto bridge actually moves value
No crypto bridge physically sends your coin anywhere. Your Ethereum stays on Ethereum. What moves is a claim on it. There are three main designs a crypto bridge can use to create that claim, and knowing which one you are trusting tells you a lot about the risk you are taking.
The lock-and-mint model is the most common. You send your token to a contract on the source chain, the contract locks it, and a matching wrapped token is minted on the destination. Wrapped Bitcoin on Ethereum works this way. The burn-and-mint model destroys the token on the chain you are leaving and issues a fresh native token on the chain you are arriving at, so supply is never duplicated. Liquidity pool bridges skip minting entirely. They keep pre-funded pools of the same asset on both chains and simply pay you out of the destination pool while topping up the source pool.
| Design | How it moves value | Where the risk sits |
|---|---|---|
| Lock-and-mint | Locks the original, mints a wrapped copy on the other chain | The locked pile is one honeypot. Break the mint logic and you print unbacked copies. |
| Burn-and-mint | Destroys the token, issues a native one on arrival | If the mint side trusts a forged burn message, new supply appears from nothing. |
| Liquidity pool | Pays you from a pre-funded pool on the destination | Drain the pool and transfers freeze. No pool, no exit. |
Notice the common thread. In every design there is a moment where the bridge has to decide whether your request is real, and a stockpile of assets waiting behind that decision. Convince the bridge that a fake event was genuine and the vault opens.
Why a crypto bridge is the most drained target on-chain
The numbers are stark. By one accounting, crypto bridge exploits account for roughly $3 billion of the $17 billion in total crypto hacks over the past decade. For a category that most users barely think about, that is an outsized share of every dollar ever stolen on-chain.
Three failure points show up again and again. The first is key compromise, where an attacker steals the private keys that authorize withdrawals. The Ronin bridge behind the game Axie Infinity fell this way in March 2022, with attackers controlling enough validator keys to sign off their own transfers and walk out with about $624 million. The second is broken verification, where the contract that checks proofs can be tricked into accepting a forged one. Wormhole lost around $326 million in February 2022 when an attacker bypassed its signature check and minted 120,000 wrapped ether with nothing behind it. The third is a plain coding mistake in setup or an upgrade. Nomad lost roughly $190 million in August 2022 after a routine update marked a zero value as valid, which turned the bridge into a free-for-all that hundreds of ordinary wallets joined within hours.
| Bridge | Amount | When | Root cause |
|---|---|---|---|
| Ronin | about $624M | March 2022 | Stolen validator keys |
| Wormhole | about $326M | February 2022 | Signature check bypassed |
| Nomad | about $190M | August 2022 | Faulty upgrade accepted junk proofs |
| Harmony Horizon | about $100M | June 2022 | Compromised signing keys |
These are not relics of one bad year. The pattern keeps repeating on smaller stages. A 2026 exploit on Hyperbridge let an attacker mint about a billion dollars of bridged DOT out of thin air, though thin liquidity meant they cashed out only a fraction of it. On the Coreum bridge, a subtle memo bug left 200,000 XRP stranded without any attacker at all, which is its own kind of failure. And when a project decides the risk is not worth it, users pay a different price: TON shut down its only bridge and left roughly 148,000 wallets scrambling to move their assets before the door closed.
How to use a crypto bridge without becoming a statistic
You cannot audit a crypto bridge contract yourself, and you should not have to. But a few habits cut most of the avoidable risk. Prefer a bridge that has been live and unbroken for years over a brand-new one promising the lowest fee, because time is the only stress test that cannot be faked. Move in smaller amounts when you can, since any bridge is riskier the moment your funds are mid-transfer than when they sit in your own wallet.
Check what you are actually holding on the other side. A wrapped token is only as good as the bridge backing it, so a wrapped asset on an obscure chain carries the credit risk of that specific bridge, not the safety of the original coin. Where a chain offers a native version of an asset instead of a wrapped one, that native version usually carries less bridge exposure. And if you are only moving funds onto an Ethereum layer 2 rollup, the official bridge run by that rollup is generally safer than a third-party shortcut, because its security is tied to Ethereum itself rather than to an outside group of signers.
FAQ: common crypto bridge questions
Is a crypto bridge the same as a crypto exchange?
No. An exchange swaps one asset for another, often on the same chain, and usually holds your funds in its own accounts. A crypto bridge keeps the asset the same and changes the chain it lives on. You can bridge USDC from Ethereum to Base and still hold USDC at the end, just on a different network.
What is a wrapped token?
It is a placeholder minted by a bridge to represent a coin locked somewhere else. Wrapped Bitcoin on Ethereum is a claim on real Bitcoin held in a vault. It trades one-for-one with the original as long as the bridge holding the reserve stays solvent and unhacked.
Can I lose money even if no one hacks the bridge?
Yes. Bugs freeze funds without a thief involved, as the Coreum case showed. Bridges also charge fees and can suffer delays when their liquidity runs thin, and a paused or retired bridge can trap assets until the team reopens it.
Why not just keep everything on one chain?
Many people do, and it is the simplest way to avoid bridge risk entirely. The pull toward bridging comes from cheaper fees, faster apps, and yields that only exist on certain chains. Every one of those benefits arrives with the transfer risk attached, and weighing the two is a personal call rather than a fixed rule.
The short version is that a crypto bridge is a convenience built on borrowed trust. It solves a genuine problem by moving value across chains that were never built to cooperate, and it quietly charges for that service in a currency you only notice when something breaks. So treat the amount you bridge as the amount you are willing to put at risk. Keep an eye on which design you are trusting and how long it has survived. Do that, and the tool tends to do its job without turning into an expensive lesson.
