Bridges and interoperability: how they work and why they get hacked
Moving tokens between blockchains is convenient, and it's been the source of some of crypto's biggest thefts.
Blockchains can't see each other, so a bridge moves value between them, usually by locking coins on one chain and minting a matching "wrapped" token on the other. The wrapped token is only as good as the bridge: if attackers trick or take over the bridge, they can mint tokens with nothing behind them or release the locked coins. In 2022 alone, the Ronin, Wormhole and Nomad bridge hacks together cost more than $1.1 billion.
How bridges work
- Lock and mint: coins are locked on chain A and a wrapped version is minted on chain B. Wrapped bitcoin (WBTC) on Ethereum works like this, with a custodian holding the BTC (see types of bitcoin).
- Burn and mint: the issuer destroys tokens on one chain and creates them on another, so there's no pool of locked coins to steal. Circle's Cross-Chain Transfer Protocol moves USDC this way.
- Liquidity networks: a provider pays you on chain B from its own funds and collects yours on chain A. Fast, but limited by the liquidity available.
Who are you trusting?
The key question is who confirms that a deposit really happened:
- A small group of signers (a multisig or validator set). Simple and fast, but if enough signers' keys are stolen, everything is gone.
- An external network of validators or oracles with its own security.
- The chains themselves, using light clients or zero-knowledge proofs to check the other chain's blocks. Most trust-minimized, hardest to build. A rollup's official bridge to Ethereum is this kind.
The big 2022 bridge hacks
| Bridge | Date | Taken | What went wrong |
|---|---|---|---|
| Ronin (Axie Infinity's sidechain) | March 23, 2022; noticed March 29 | 173,600 ETH and 25.5 million USDC, about $625 million at the time | Attackers obtained 5 of the 9 validator keys needed to approve withdrawals: four held by Sky Mavis and one from Axie DAO. The FBI attributed the theft to North Korea's Lazarus Group. |
| Wormhole (Solana ↔ Ethereum) | February 2, 2022 | 120,000 wrapped ETH minted on Solana with nothing behind it, worth over $320 million | A bug let the attacker bypass the signature check on Solana. Jump Trading, Wormhole's backer, replaced the ETH the next day. |
| Nomad | August 1, 2022 | About $190 million | An upgrade marked an empty value as a trusted root, so unproven messages were accepted. Once one attacker showed how, hundreds of copycats repeated it. |
The pattern: the blockchains themselves weren't broken. A small set of keys, one verification bug or one bad configuration in the bridge was enough.
Example: what "wrapped" really means
You bridge 1 ETH from Ethereum to another chain and receive 1 "ETH" there. What you actually hold is a claim on the 1 ETH locked in the bridge contract. If the bridge is drained, as Wormhole's was, the wrapped token can lose its backing overnight unless someone steps in, as Jump did. Two tokens with the same name on the same chain, bridged by different bridges, are different assets.
Using bridges more safely
- Prefer the official route: a rollup's own bridge, or the token issuer's native transfer (such as Circle's for USDC).
- Type the address yourself. Fake bridge sites in search ads are a common wallet-draining scam.
- Send a small test first, and make sure the receiving network is exactly right (see before you send crypto).
- Don't leave large amounts in wrapped tokens longer than you need to.
Limitations
- Every bridge adds a new trust assumption on top of both chains.
- Stolen funds are rarely recovered in full; when users are made whole, it's usually because a company or investors paid, as Jump did for Wormhole.
- Interoperability standards are improving, but there's no universal, risk-free way to move value between unrelated blockchains.
Frequently asked questions
What is a crypto bridge?
A system that lets you move tokens or messages from one blockchain to another, usually by locking them on one chain and issuing a matching token on the other.
Why do bridges get hacked so often?
They hold large pools of locked funds and depend on a small set of keys or complex verification code. Breaking either can release or mint huge amounts.
What was the biggest bridge hack?
Ronin in March 2022, about $625 million at the time, attributed by the FBI to North Korea's Lazarus Group.
Is a wrapped token the same as the original?
No. It's a claim on the original held by the bridge or a custodian. If the bridge fails, the wrapped token can lose its value.
Do I need a bridge to move crypto between networks?
Not always. Many exchanges let you deposit on one network and withdraw on another, which puts your trust in the exchange instead of a bridge.
Where to next
Sources
- Bridges (ethereum.org)
- FBI statement on attribution of the March 2022 theft to Lazarus Group
- Sky Mavis' Ronin bridge exploited for over $625M (Blockworks)
- Wormhole bridge exploit incident analysis (CertiK)
- Hack analysis: Nomad bridge, August 2022 (Immunefi)
- Cross-Chain Transfer Protocol (Circle developer docs)
Written for beginners and checked against the sources listed. Last reviewed November 4, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.