Bridges move assets between different blockchains. Every user who has ever moved USDC from Ethereum to Arbitrum, or ETH to Solana, has used a bridge. Bridges are also the single most-exploited category in DeFi — collectively they've lost over $2 billion to hacks. Understanding how bridges actually work, what makes them safe or dangerous, and which bridges are meaningfully different from each other is required literacy for anyone moving assets between chains.
The core problem bridges solve
Chains don't naturally know about each other. Bitcoin has no idea what's happening on Ethereum. Ethereum has no idea what's happening on Solana. Each chain has its own state, its own consensus, its own assets.
But users want to move value between chains. A bridge is a mechanism that lets you have "the same asset" on multiple chains — deposit ETH on Ethereum, receive some equivalent on another chain that's tradeable there, later redeem it back for real ETH.
The trick is: the "equivalent on the other chain" isn't really ETH. It's a claim on ETH that's locked somewhere else. The bridge is the entity that maintains this equivalence.
Design pattern 1: Lock-and-Mint
The most common bridge design:
1. User deposits ETH into the bridge contract on Ethereum (locked in a vault). 2. The bridge attests that this deposit happened. 3. The bridge mints wETH (or similar) on the destination chain, giving it to the user. 4. To bridge back: user burns wETH on destination chain, bridge attests, ETH is released from the vault.
The wETH is a derivative — its value depends on the vault continuing to hold real ETH and the bridge continuing to honor redemptions. If the vault gets hacked, the wETH becomes worthless because there's nothing backing it.
This is how most bridges work: Wormhole, Multichain (before collapse), Portal, Stargate, cBridge, and many others.
Design pattern 2: Burn-and-Mint (native issuance)
Some bridges avoid the vault by having control over asset issuance:
1. User burns USDC on Ethereum via Circle's CCTP (Cross-Chain Transfer Protocol). 2. Circle attests to the burn via signed messages. 3. New USDC is minted on the destination chain.
The USDC on the destination is genuinely "the same" USDC — not a wrapped derivative. Circle controls issuance on all chains, so it can burn on one and mint on another without a vault.
This is how canonical USDC works on all supported chains. It's much safer than lock-and-mint because there's no vault to exploit.
Design pattern 3: Canonical bridges
Layer 2s typically have "canonical bridges" — the official bridge maintained by the L2 team that's tightly integrated with the L2's security model.
Canonical bridges use the L2's underlying security. For an optimistic rollup like Arbitrum: to bridge assets back to Ethereum, you initiate a withdrawal that takes 7 days (the challenge period). During those 7 days, honest validators can dispute a fraudulent withdrawal.
This is slow but very secure. Canonical bridges have never been exploited to the same degree as third-party bridges because their security is inherited from the underlying L1.
The exploit history
Almost every non-canonical bridge has been exploited. A brief history:
**Poly Network (August 2021)**: $611M stolen from a smart contract exploit. Remarkably, the attacker returned everything after negotiating with the team.
**Wormhole (February 2022)**: $325M stolen via signature verification bug. Jump Crypto (Wormhole's backer) bailed out the protocol.
**Ronin Bridge (March 2022)**: $625M stolen. Attacker compromised 5 of 9 validators via social engineering. Axie Infinity users were the primary victims.
**Nomad (August 2022)**: $190M stolen after an initialization bug allowed anyone to withdraw any asset. Was a "free for all" exploit — many users participated.
**Multichain (July 2023)**: ~$130M stolen. The bridge team's CEO was allegedly detained by Chinese authorities; the multi-sig keys became inaccessible. Users lost most of their funds.
**Orbit Bridge (December 2023)**: $80M stolen.
The pattern: bridges are attractive targets because they hold large amounts of assets, they're often less-audited than the underlying protocols they connect, and their trust model (usually a set of validators) is a single point of failure.
What makes a bridge risky
The security of a bridge depends on:
**Who controls asset release?**
- Single multi-sig: least secure. Any threshold compromise = drain.
- Distributed validator set: better, but only as secure as the weakest validator.
- Optimistic proofs (challenge period): quite secure but slow.
- Cryptographic proofs (zk-based): most secure in principle, still novel in practice.
**How is the trust maintained?**
- Team-run: depends entirely on the team's continued existence and honesty.
- Decentralized validators: depends on those validators' incentives and security.
- Protocol-inherent (canonical bridges): inherits from the underlying protocol.
**What's the failure mode?**
- Vault drain: users lose the bridged asset entirely.
- Message forgery: attacker can mint tokens without depositing collateral.
- Frozen funds: bridge stops functioning, users can't bridge back (Multichain scenario).
Modern approaches
Newer bridge designs try to be more robust:
**Wormhole (post-fix)**: uses a set of "guardians" (validators) to attest to cross-chain messages. Redundancy helps but the trust set is still curated.
**LayerZero**: uses an "ultra-light node" model with configurable oracle and relayer sets. Users can choose their trust profile.
**Chainlink CCIP**: uses Chainlink's oracle network for attestation, with an independent risk management network.
**Axelar**: uses its own PoS chain with validators securing cross-chain messages.
**Circle CCTP**: burn-and-mint for native USDC. Bypasses vault risk entirely for USDC transfers.
**Across / Hop**: use market makers to provide fast bridging, with slower canonical settlement for finality.
Bridge aggregators
Because so many bridges exist, users often use aggregators:
- LI.FI: aggregates across many bridges, picks the best route for you.
- Bungee: similar, optimized for fee and speed.
- Socket: aggregation infrastructure used by many apps.
Aggregators add convenience but also complexity — you're trusting the aggregator's routing logic plus the underlying bridge they route through.
Practical guidance for bridging
For any bridging operation:
1. Prefer canonical bridges when moving to/from L2s. Slower but much safer. 2. For rapid bridging, use aggregators but understand which underlying bridge is being used. 3. For USDC transfers, prefer Circle CCTP (burn-and-mint) when available. 4. Never bridge more than you're willing to lose, especially to newly-launched chains. 5. Check bridge status pages before large operations — bridges have downtime and issues. 6. Watch for phishing — fake bridge sites are one of the most common scam vectors.
Which bridges to trust
As of 2026, the safest bridges:
- **Canonical bridges** for major L2s (Arbitrum, Optimism, Base, zkSync).
- **Circle CCTP** for USDC transfers.
- **Chainlink CCIP** for messages and select asset transfers.
- **LayerZero** with well-chosen trust profiles.
Bridges I'd hesitate to use for large amounts:
- New or unaudited bridges to newly-launched chains
- Bridges with a single team-controlled multi-sig
- Bridges where the underlying trust model is unclear
Cross-chain messaging (not just assets)
Modern bridges also enable arbitrary message passing — a smart contract on Ethereum triggering an action on Arbitrum without any assets moving. LayerZero, Wormhole, Axelar, and Chainlink CCIP all offer this.
Message-passing bridges have the same trust and security concerns as asset bridges, plus the additional risk that the receiving contract's logic can be exploited via the bridged messages.
The direction of travel
Bridge design continues to evolve. Zero-knowledge proofs are increasingly used to secure cross-chain messages. Native issuance (like Circle CCTP) is spreading to other assets. Canonical bridges are becoming faster (via specialized proving systems).
Long-term, the vision is bridges that are as secure as the underlying L1 they connect, without the vault-based single-point-of-failure that has caused so many hacks. This is technically achievable but non-trivial.
For now, bridging remains one of DeFi's riskier activities. Treat every bridge transaction as potentially risky, size it appropriately, and prefer canonical mechanisms when they're available.
