Crypto Decoded

What is a crypto bridge, and why do bridges get hacked?

Crypto bridges connect blockchains but hold billions in locked assets, making them prime targets. Here is how they work and why they keep getting hacked.

By Oliver Crane · May 20, 2026

Billions of pounds have been stolen from crypto bridges in the past few years. To understand why, you first need to understand what bridges actually do, and why the technology is so difficult to secure.

Reviewed by Priya Nair, Editorial Director · May 21, 2026, 22:40

In this article

The Short Version

Key Takeaways

A crypto bridge is software that lets you move assets from one blockchain to another by locking tokens on one chain and issuing equivalents on another.
Because a crypto bridge holds large reserves of locked assets, it is one of the most attractive targets in all of crypto.
Several of the largest thefts in crypto history have targeted a crypto bridge, including the $625 million Ronin hack in 2022.
Smart contract bugs and compromised private keys are the two main attack vectors.
Using a crypto bridge carries real risk: stick to well-audited protocols and transfer only what you can afford to lose.

Why Blockchains Cannot Naturally Talk to Each Other

Bitcoin and Ethereum are entirely separate networks. They have different rules, different validators, and different underlying technology. A bitcoin held on the Bitcoin blockchain cannot simply be sent to an Ethereum.

Address in the way you might transfer money between two bank accounts. The networks have no shared language.

This is by design. Each blockchain is a closed system, optimised for its own purposes. Bitcoin prioritises security and scarcity.

Ethereum prioritises programmability. Solana prioritises speed. The trade-off is that they cannot natively communicate, and moving value between them requires an intermediary.

That intermediary is a crypto bridge.

How a Crypto Bridge Actually Works

The most common method is called lock-and-mint. Here is the basic sequence. You send your tokens to the bridge’s smart contract on the source blockchain.

The contract locks them there. On the destination blockchain, the bridge then issues a corresponding number of “wrapped” tokens, which represent your original asset. You can use those wrapped tokens within the destination ecosystem.

When you want your original tokens back, you return the wrapped tokens, they are burned, and the originals are unlocked on the source chain.

A simpler analogy: imagine depositing a physical pound coin into a machine at the airport. The machine locks the coin and issues you a voucher for one pound. You use the voucher on the other side.

When you return, you hand back the voucher and get your coin. The machine is the bridge. The voucher is the wrapped token.

Some crypto bridges use a different model called liquidity pools. Instead of lock-and-mint, both sides of the bridge hold reserves of each asset. When you cross from one chain to another, you deposit into the source pool and withdraw from the destination pool.

The bridge rebalances the pools over time. This avoids the need for wrapped tokens but introduces different risks around pool depth and imbalance.

Why Bridges Are Such a Target for Hackers

The answer is straightforward: a crypto bridge holds a lot of money in one place. According to blockchain analytics firm Chainalysis , bridge hacks accounted for around 69 per. Cent of all crypto stolen in 2022, making the crypto bridge the most exploited single category in the space that year.

When the lock-and-mint model is in use, the bridge’s smart contract on the source chain accumulates enormous reserves. If a bridge is popular, hundreds of millions, or even billions, of pounds worth of tokens can sit in that contract at any one time. For a hacker, that is an irresistible target.

The attack surface of any crypto bridge is also unusually wide. It is not just one smart contract. It involves contracts on multiple blockchains, an off-chain system that monitors both chains and passes messages between them.

A set of validators or guardians who verify those messages, and a set of keys that authorise transactions. A weakness in any one of these components can be enough to drain the entire bridge.

Smart contract bugs are one route. If the code that verifies a message or mints wrapped tokens contains an error. An attacker can exploit it to mint tokens without ever depositing anything on the source chain. The bridge essentially writes itself unlimited IOUs.

Compromised private keys are another route. Many bridges rely on a small group of validators or a multi-signature wallet to approve transactions. If an attacker can compromise enough of those private keys, they can authorise fraudulent withdrawals directly.

The Biggest Bridge Hacks in Crypto History

The scale of bridge losses gives a sense of the risk involved.

The Ronin crypto bridge hack in March 2022 remains the largest crypto theft on record. Ronin was the bridge used by the Axie Infinity play-to-earn game. Attackers compromised five of the nine validator private keys that governed the bridge and used them to authorise two fraudulent withdrawals totalling around $625 million.

The hack was not discovered for six days. The US government later attributed it to Lazarus Group, the North Korean state-sponsored hacking organisation.

The Wormhole hack in February 2022 was a smart contract exploit. An attacker found a flaw in the code that verified whether wrapped ETH had been properly deposited before minting. By bypassing that check, they minted 120,000 wrapped ETH, worth around $320 million at the time, without depositing anything. Wormhole’s parent company covered the loss and the bridge continued operating.

The Nomad Bridge hack in August 2022 was unusual in that it was carried out by hundreds of different actors. A routine code update introduced a bug that meant almost any message could be validated as legitimate. Once the first attacker discovered the exploit, others copied the technique and joined in. Around $190 million was drained within hours.

A Worked Example

Suppose you hold ETH on the Ethereum mainnet and want to use a DeFi application that only runs on Arbitrum, an Ethereum layer 2 network. You go to a bridge, connect your wallet, and deposit 1 ETH. The bridge’s smart contract on Ethereum locks your ETH.

A few minutes later, 1 ETH appears in your wallet on Arbitrum. You use the DeFi application. When you are done, you return through the bridge.

You send your Arbitrum ETH back to the bridge contract. It is burned. Your original ETH is unlocked on Ethereum mainnet and returned to your wallet.

At no point did your ETH actually travel between chains. What travelled was a message. The bridge locked your asset on one side and issued a claim against it on the other.

The risk is that if the bridge is exploited between the moment you lock. And the moment you return, your underlying ETH may be gone even though you still hold wrapped tokens that are now worthless.

What This Means For You

Most everyday crypto holders will not need to use a crypto bridge frequently. If you are simply holding bitcoin or ETH, you have no reason to cross chains at all.

If you do use bridges, the most important principle is to minimise the amount. You transfer and the time you spend with assets on the bridge. Do not treat a bridge as a place to store value. Move through it quickly and move only what you need.

Choose bridges that have been independently audited by reputable security firms and have been running without incident for a meaningful period. Newer bridges with large promotional yields are a warning sign. The yield often reflects the risk.

Be sceptical of any wrapped token. Its value is only as good as the bridge that backs it. If the bridge is drained, the wrapped token becomes worthless, regardless of what the underlying asset is worth. This is a risk that does not exist when you hold native assets directly.

In Plain English

A crypto bridge is a service that lets you move tokens from one blockchain. To another by locking them on the source chain and issuing equivalent tokens on the destination chain. Because bridges accumulate large reserves of locked assets, they are prime targets for hackers.

Several have been drained for hundreds of millions of pounds through smart contract bugs or compromised keys. Using a bridge is a genuine risk, not a theoretical one, and you should treat it as such.

Reviewed by Cristoniq Editorial · May 2026