Bridge compromise: why cross-chain links keep failing

A bridge lets an asset on one chain be represented on another, and a bridge compromise is any event in which that representation stops being backed by what it claims. The structural reason bridges fail more often, and more expensively, than most other infrastructure is that they hold pooled collateral behind a single verification decision. If that decision can be forged or the keys that make it can be stolen, every unit issued on the far side becomes an unbacked claim at once.

What a bridge is actually doing

Chains cannot read each other. A bridge therefore takes an assertion about one chain and makes a contract on another chain act on it. Three constructions dominate. Lock-and-mint holds the original asset in a contract on the source chain and mints a wrapped token on the destination; burn-and-mint destroys units on one side and issues them on the other, which requires the issuer to be the same on both; and a liquidity network keeps pools on both sides and pays out locally, so no new representation is created but the pools must be funded. In all three the security question reduces to one thing: who or what is trusted to attest that the event on the far chain really happened.

The four ways they have actually broken

The recorded failures cluster tightly. The first is key compromise: enough signing keys in an external set are obtained, usually through targeted intrusion rather than cryptography, and withdrawals are authorized that no deposit ever funded. The March 2022 compromise of the Ronin bridge, in which a majority of a small validator set was taken over, is the reference case. The second is a verification defect: the contract accepts a message it should have rejected, which is what happened in the February 2022 Wormhole incident, where a flaw in signature verification allowed tokens to be minted without a genuine deposit. The third is an accounting error in the deposit path, where a call is crafted so the bridge records a deposit that did not occur or credits it twice. The fourth is privileged access: an upgrade function, an owner role or a migration path lets whoever holds it move funds directly, which is admin key risk wearing a bridge costume.

The wrapped asset is where the exposure sits

When backing disappears, the units on the destination chain do not vanish. They continue to exist, transfer and appear in balances while representing a claim on collateral that is gone. The market price then separates from the reference asset, sometimes abruptly and sometimes over days as the shortfall becomes clear. The contagion path runs through everything that accepted the wrapped asset as if it were the original: a lending protocol holding it as collateral, a liquidity pool pairing it with a sound asset, and any oracle that priced it at the reference rather than at its own market. This is why bridge risk cannot be assessed asset by asset in isolation. A holder who never used a bridge can still be exposed through a pool, a vault or a money market that did.

Recovery, where it has happened, has come from outside the protocol rather than from any mechanism inside it. In some cases a well-capitalized backer replaced the missing collateral, restoring the peg of the wrapped asset by choice rather than by obligation. In others the shortfall was socialized across users, or a portion was returned after negotiation with the attacker. None of these is a property a reader can rely on in advance, and each depends on the identity and balance sheet of whoever stands behind the bridge, which is a question about a company rather than about cryptography. The general messaging systems that succeeded simple asset bridges widen the surface further, since they carry arbitrary instructions rather than transfers, and a forged message can therefore do more than mint a token.

What can be established before rather than after

Several things are checkable in advance and are frequently not checked. How many keys authorize a withdrawal, how many are required, and whether the holders are independent parties or one organization. Whether the signer set is bonded, and whether the bond is meaningful relative to the value secured. Whether the bridge contract is upgradeable, by whom, and with what delay. Whether the destination asset is issued by the same party as the original, since burn-and-mint by a single issuer is a different risk from a third-party wrapper. And whether the route is native to the destination chain's own security, as a rollup bridge is, or an independent system layered on top. Value locked, visible as TVL, is worth reading here as target size rather than as reassurance, because a bridge holding more is worth more to attack while offering the same verification decision.

Governance and administrative powers, examined next, are the thread running through the fourth failure class above. The incidents record catalogs bridge failures in detail, and the TVL pages show where cross-chain value is currently concentrated.