Bridges, wrapped tokens and the record of bridge exploits
Nothing crosses between chains: assets are immobilized on one side and a claim is issued on the other, which is only as sound as its guard.
A bridge does not move an asset from one blockchain to another. It immobilizes the asset on the first chain and issues a claim on the second, and the claim is worth what the mechanism guarding the immobilized assets is worth. Bridges have accounted for several of the largest single losses in the industry, and the reason is structural rather than accidental.
Three ways to guard the deposit, and one special case
The most common design locks assets in a contract and mints a wrapped token on the destination chain when an external set of signers attests that the deposit happened. The security of every wrapped unit is then the security of that signer set, which is often a multisignature arrangement of a modest number of parties. This is a custodial arrangement described in the vocabulary of decentralization.
The second design verifies the source chain's consensus directly on the destination chain, using a light client or, increasingly, a zero-knowledge proof that a state transition occurred. There is no committee to compromise; the trust moves into the correctness of the verification code and the security of the source chain itself. The third design avoids issuing claims at all: liquidity providers hold inventory on both chains and a transfer is a pair of local trades, which caps the loss from any single failure at the inventory rather than the entire escrow.
Rollup bridges are a special case worth separating. A rollup's canonical bridge is part of its protocol: assets are held on the base layer, and the rollup's state is either proven with a validity proof or assumed correct subject to a challenge period backed by a fraud proof. The security is the base layer's, with the important caveat that an optimistic rollup withdrawal must wait out the challenge window, and that most rollups retain an upgrade key and a privileged sequencer.
Why bridges concentrate attacks
An escrow contract is a permanently funded, publicly known, immobile target. Unlike an exchange, it cannot move the bulk of its holdings to cold storage, because the assets must remain available for withdrawal at any moment. Its code is public, its balance is public, and the defenders have to be right continuously while an attacker has to be right once. On top of that, a bridge is a translation layer between two systems with different assumptions about finality and message ordering, and translation layers are where specification errors live.
| Failure class | Mechanism | Documented case |
|---|---|---|
| Key compromise | Enough of the external signer set is obtained that the attacker can authorize their own withdrawal | Ronin, March 2022: roughly 620 million dollars, after five of nine validator keys were controlled |
| Faulty signature verification | The contract accepts a forged attestation for a deposit that never occurred, minting unbacked wrapped tokens | Wormhole, February 2022: roughly 320 million dollars of wrapped ether minted without backing |
| Broken message validation | An upgrade leaves a default value treated as a valid proof, so any message can be replayed with a new recipient | Nomad, August 2022: roughly 190 million dollars, drained by many participants copying one transaction |
| Privileged function exposure | An externally reachable function lets an attacker change the set of authorized signers | Poly Network, August 2021: roughly 610 million dollars, subsequently returned by the attacker |
Read together, these are not exotic cryptography failures. Two are ordinary access control problems, one is an upgrade that changed an assumption elsewhere in the code, and one is key management. A bridge exploit is usually the failure of something a competent engineer would recognize immediately in isolation, and did not see in combination.
What the wrapper actually is
A wrapped asset carries the credit of its bridge, not of the asset it names. Two wrapped versions of the same underlying token, issued by different bridges onto the same chain, are separate assets that do not net against each other, cannot be pooled together without a conversion, and can trade at different prices. If a bridge's escrow is drained, the wrapped units on the far side remain, backed by nothing, while the original asset is entirely unaffected. That asymmetry is why a bridge failure produces a permanent discount in one token rather than a fall in the underlying, and why a wrapper's price relative to the asset it references is a live measurement of confidence in the bridge.
This has knock-on effects wherever the wrapper has been used as collateral, priced by an oracle that reads the underlying's price on the assumption that the two are the same thing. A protocol that made that assumption will keep valuing an unbacked token at full price until somebody changes the feed, which is a governance action taken under pressure.
What reduces the surface
- Native issuance, in which the asset's own issuer mints directly on each chain and burns on the other, removing the escrow entirely. This substitutes issuer trust for bridge trust, which is a different question rather than no question.
- Verification instead of attestation, using light clients or validity proofs, so that the guarantee is mathematical rather than a count of signatures.
- Rate limits and delayed withdrawals above a threshold, which convert an instant total loss into a detectable event with time to trigger a pause.
- Independent verification paths, so that no single implementation error authorizes a withdrawal.
- Published, monitored escrow balances, since an unbacked mint is visible as a divergence between locked and issued supply before it is visible in a price.
The incident record catalogs these events by mechanism and size, the value locked pages show how much sits in bridge escrows and how weekly changes in those balances move, and the risk section lists which wrapped representations a given protocol's collateral actually consists of. Peg deviation applies to wrapped assets as much as to stablecoins and is often the first public sign that something is wrong.