What Are the Security Risks of Cross-Chain Asset Bridges? Historical Cases
Key Takeaway on Cross-Chain Bridge Security: Attack Surface Centers on Verification, with Cumulative Losses Over $2.83 Billion
The security risks of cross-chain bridges stem from a core challenge:how does one blockchain verify that an event has actually occurred on another chain?This verification process involves multiple components, and a failure in any one can lead to stolen funds.
As of April 2024, cross-chain bridges have suffered cumulative losses of approximately$2.83 billionfrom security incidents, accounting for nearly36.42%of all stolen funds in the Web3 space. Between 2021 and 2024, about 40% of all crypto theft amounts originated from cross-chain bridge attacks.
1. Root Causes: Why Are Cross-Chain Bridges Always Targeted?
Cross-chain bridges become prime targets for hackers primarily because their architecture naturally concentrates three high-value objectives:
Huge Locked Assets: Bridge contracts typically hold large amounts of highly liquid assets like USDC and ETH. Once breached, these funds can be directly extracted.
Complex Trust Verification Mechanisms: A blockchain cannot natively read the state of another chain. It must rely on mechanisms such as validator signatures and relay systems—the more complex the mechanism, the larger the attack surface.
User Difficulty in Assessing Security Status: A normally functioning cross-chain interface does not guarantee that the backend signers or contract permissions are secure.
2. Historical Attack Cases: Vulnerability Type Analysis
Attack methods on cross-chain bridges vary, but the core goal is always tomake the bridge believe a message that should not be trusted.
1. Smart Contract Logic Flaw—Insufficient Verification (Latest Case 2026)
In May 2026, theVerus Protocol Ethereum Bridgewas attacked, resulting in a loss of approximately$11.6 million. Security firm analysis indicated that the root cause was not a private key leak but alack of validation for the source chain transfer amountin the bridge contract's Solidity logic. The attacker sent a forged cross-chain message, and the bridge released funds without verifying the actual amount.
2. Configuration and Operational Flaw—Single Point of Failure (Largest Case 2026)
In 2026,Kelp DAOwas attacked due to a LayerZero cross-chain configuration issue, losing approximately$290 million. Some security agencies have linked this event to the Lazarus Group. The core vulnerability was that Kelp used asingle DVN (Decentralized Verification Network)for cross-chain verification, creating a single point of failure that compromised the entire system. LayerZero stated the issue lay in the project's configuration approach.
3. Forged Messages and Infinite Minting (Novel Attack 2026)
In April 2026, an attacker usedforged cross-chain messagesto take control of the bridged DOT token contract onHyperbridge,minting 1 billion bridged DOT tokens out of thin airand dumping them. The initial loss was about $237,000, with subsequent assessments placing the actual loss near$2.5 million—the relatively small amount being due to the limited liquidity of the asset pool.
4. Private Key Leak or Permission Loss of Control—Centralization Risk (2023)
In July 2023,Multichainexperienced large-scale unauthorized withdrawals, losing nearly$130 million. The incident was directly linked to the founder going missing and unclear control over admin private keys.
5. Malicious Code Injection—Arbitrary Call Vulnerability (2024)
In July 2024, the cross-chain aggregatorLi.Fisuffered from anarbitrary call vulnerabilityin a newly deployed contract. Attackers exploited this to drain assets from users who had granted approvals, stealing approximately$11.6 million. The root cause was that user-controllable parameters were passed to a low-level function capable of executing arbitrary function calls.
6. Largest Historical Attacks—Ronin and Nomad
Ronin Bridge (2022): The Ronin cross-chain bridge for Axie Infinity was attacked, losing approximately$611 million, making it the largest cross-chain bridge hack to date.
Nomad Bridge (2022): Due to a security vulnerability in newly deployed smart contract code, nearly all assets in the bridge (about$190 million) were drained. The U.S. Federal Trade Commission (FTC) subsequently sued Nomad, alleging inadequate security measures.
3. Emerging Attack Technique: Cross-Chain Sandwich Attack
Beyond directly breaking contracts, attackers also exploitinformation asymmetrywithin cross-chain mechanisms for profit.
A 2025 academic study found that by monitoring events emitted by cross-chain protocols on the source chain, attackers could learn about upcoming transactions on the destination chain in advance. This allowed them to executesandwich attacksahead of regular MEV bots. Over a two-month observation period, this attack yielded approximately$5.27 millionin profit on the Symbiosis protocol, accounting for1.28%of total cross-chain transaction volume during that period. In comparison, traditional single-chain sandwich attacks on the same dataset yielded only about$6,109. The most frequently targeted pool was theBUSD/WBNB pool on the BSC network.
4. Core Operational Mechanisms of Cross-Chain Asset Transfers
Understanding the risks requires knowledge of the basic cross-chain bridge models:
| Model | Operation Method | Typical Risk |
|---|---|---|
| Lock-Mint | Assets locked on source chain, wrapped tokens minted on destination chain | Wrapped tokens may de-peg; validators if compromised can mint infinitely |
| Lock-Unlock | Assets locked on source chain, native assets released from liquidity pool on destination chain | Depends on liquidity pool depth; pool assets are attack targets |
| Burn-Mint | Assets burned on source chain, native assets minted by issuer on destination chain | Depends on the security of the issuer's centralized service |
Currently, most mainstream bridges employ anexternal verificationmechanism—a set of trusted validators (Guardians) collectively confirm cross-chain events. In this model,the security of validator private keysis the most vulnerable point of the entire system.
5. Practical Advice for Ordinary Users
Users cannot directly fix a bridge's security vulnerabilities, but they can reduce their own exposure risk:
Avoid Unlimited Approvals: When approving tokens for a cross-chain transfer, set an allowance close to the actual amount needed, rather than an unlimited approval. In the Li.Fi incident, attackers drained assets from users who had granted unlimited allowances.
Use Official or Well-Known Bridges for Large Transfers: Prioritize bridges that have been tested over time, undergone multiple audits, and have a high total value locked (TVL). 2025 data shows that bridge vulnerabilities now account for50.1%of all crypto theft amounts.
Test with Small Amounts: On unfamiliar bridges, first test the path and confirmation time with a small amount of assets.
Monitor Project Announcements: After a security incident, avoid using the affected bridge or trading related wrapped assets immediately, as attackers may still hold unbacked tokens.
Regularly Revoke Approvals: Use wallet authorization management tools to periodically check and revoke approvals for cross-chain bridges that are no longer in use.
Confirmation Method: After completing a cross-chain operation, check the transaction status on theblock explorers of both the source and destination chainsto confirm that assets were successfully locked/burned and minted/released on the target chain, rather than relying solely on the front-end display. Also, verify that the contract address of the asset received on the destination chain matches the official contract published by the protocol to avoid receiving counterfeit tokens.
