Bridge Exploit

What Is a Bridge Exploit?

A bridge exploit is a security breach in which an attacker compromises a cross-chain bridge to steal, mint, or redirect digital assets. Because bridges hold large pools of locked assets that back wrapped tokens on destination chains, they represent some of the highest-value targets in all of crypto.

Cross-chain bridges work by locking assets on one chain and issuing corresponding representations on another. A user deposits 10 ETH into a bridge contract on Ethereum and receives 10 wrapped ETH on a destination chain. The bridge must correctly verify that the deposit happened before issuing the wrapped tokens. If an attacker can forge that verification, bypass the bridge's signature checks, or steal the keys that authorize withdrawals, they can drain the locked assets or mint unbacked tokens.

Bridge exploits have been among the largest single-event losses in cryptocurrency history. In 2022 alone, five major bridge hacks accounted for roughly $1.3 billion in stolen funds, representing over half of all crypto losses that year. The structural complexity of bridging assets across heterogeneous blockchains creates an attack surface far larger than that of any single-chain application.

How Bridge Exploits Work

Bridge exploits generally fall into three categories, each targeting a different layer of the bridge's architecture. Understanding these attack vectors is essential for evaluating bridge security models.

Private Key Compromise

Many bridges rely on a multisig or validator set to authorize cross-chain transfers. If an attacker gains control of enough signing keys to meet the threshold, they can approve arbitrary withdrawals. This category includes:

• Direct key theft through phishing, malware, or compromising the infrastructure hosting validator nodes
• Social engineering to gain access to key management systems or HSMs
• Exploiting weak operational security where too few entities control too many keys

The Ronin Bridge and Harmony Horizon hacks both fell into this category. Security depends not on code correctness but on the operational practices of key holders, which makes this vector particularly difficult to audit.

Smart Contract Bugs

Logic errors in the bridge's smart contracts can allow attackers to withdraw or mint tokens without a valid deposit. Common patterns include:

• Signature verification bypass: using deprecated or insecure functions that fail to properly validate authorization
• Unrestricted external calls: privileged contracts accepting user-controlled target addresses and calldata, allowing attackers to impersonate authorized callers
• Reentrancy and state manipulation: exploiting the order of operations in contract logic to drain funds before balances update

The Wormhole exploit demonstrated this pattern when an attacker bypassed signature verification through a flaw in how the bridge validated Solana system program addresses.

Faulty Verification Logic

Even when keys are secure and contracts are free of traditional bugs, flawed message verification can allow attackers to forge proofs that a deposit occurred. This includes:

• Initialization errors: a trusted root set to a default value (like zero) that causes the bridge to accept any message as valid
• Proof forgery: crafting fake Merkle tree or IAVL proofs that pass on-chain validation
• Oracle manipulation: feeding false data to the bridge's verification layer

The Nomad hack is the canonical example: a routine upgrade set a trusted Merkle root to 0x00, causing the bridge to treat every message as pre-approved. Unlike most exploits, this was not a single attacker: once the vulnerability became public, hundreds of addresses replicated the transaction to drain funds.

Major Bridge Exploits

The following incidents illustrate the scale and variety of bridge exploits. Each targeted a different vulnerability class, demonstrating that no single defense is sufficient.

Ronin Bridge: $625 Million (March 2022)

The Ronin Bridge connected the Ronin sidechain (used by the game Axie Infinity) to Ethereum. It used a 5-of-9 validator multisig to authorize withdrawals. Sky Mavis, the company behind Axie Infinity, directly controlled four validators. A fifth signature was available through a temporary delegation from the Axie DAO that had never been revoked.

The attacker, later attributed to North Korea's Lazarus Group, compromised Sky Mavis's systems and used the five keys to authorize two withdrawals: 173,600 ETH and 25.5 million USDC. The exploit went undetected for six days, discovered only when a user reported being unable to withdraw 5,000 ETH.

Wormhole: $326 Million (February 2022)

Wormhole is a messaging protocol connecting Ethereum, Solana, and other chains. The attacker exploited a vulnerability in the Solana-side contract's signature verification. By using a deprecated function that did not properly validate the system program address, the attacker bypassed guardian signature checks and minted 120,000 wETH on Solana without depositing any ETH on Ethereum. Jump Crypto, Wormhole's backer, replaced the 120,000 ETH to make users whole.

Nomad: $190 Million (August 2022)

Nomad used an optimistic verification model where messages were accepted after a challenge window unless disputed. A routine smart contract upgrade initialized a trusted Merkle root to zero. In Solidity, the default mapping return value is also zero, so the bridge treated every message as already proven and confirmed.

Once the first exploit transaction appeared on-chain, anyone could copy it, replace the recipient address, and rebroadcast. This turned the exploit into a chaotic free-for-all. Roughly $22 million was eventually returned by white-hat participants.

Harmony Horizon: $100 Million (June 2022)

Harmony's Horizon bridge connected Harmony to Ethereum and Binance Smart Chain using a 2-of-5 multisig. The attacker compromised two private keys, which was sufficient to authorize withdrawals. The low signing threshold meant that breaching just two key holders was enough to drain the bridge of roughly $100 million in various tokens. The funds were subsequently laundered through mixers.

Why Bridges Are High-Value Targets

Several structural properties make bridges uniquely attractive to attackers compared to other DeFi protocols:

• Concentrated value: bridges aggregate large pools of locked assets in a small number of smart contracts, creating single points of failure with massive payoffs
• Cross-domain complexity: verifying events across heterogeneous blockchains requires bridging consensus mechanisms, execution environments, and finality models, which multiplies the attack surface
• Asynchronous operations: the delay between a deposit on one chain and confirmation on another creates windows for exploitation that do not exist in same-chain transactions
• Trust assumptions: most bridges introduce additional trust beyond the underlying chains, whether through validator sets, relayers, or oracle networks
• Irreversibility: unlike traditional financial fraud, stolen crypto assets on permissionless chains generally cannot be reversed or frozen (with limited exceptions for centralized stablecoins)

Defense Mechanisms

Bridge security has evolved significantly since the 2022 wave of exploits. Modern designs employ several layers of defense, though each comes with tradeoffs.

Multisig with Diverse Signers

The simplest improvement over early bridges is increasing both the number and diversity of signers. Rather than a 2-of-5 multisig operated by a single organization, robust designs use higher thresholds (such as 13-of-19) with signers distributed across independent entities, geographic regions, and infrastructure providers. This raises the cost of key compromise attacks but does not eliminate them.

Optimistic Verification with Fraud Proofs

Optimistic bridges accept cross-chain messages by default and rely on a challenge window (typically 30 minutes to 7 days) during which watchers can submit fraud proofs to dispute invalid messages. Security requires only one honest watcher to be online during each window. The tradeoff is latency: users must wait for the challenge period to expire before their transfers finalize.

Zero-Knowledge Proof Bridges

ZK bridges replace trusted signers with cryptographic proofs. Instead of relying on a validator set to attest that a deposit happened, the bridge generates a succinct proof of the source chain's consensus that can be verified on-chain on the destination chain. This eliminates the validator compromise attack vector entirely.

However, ZK bridges shift risk to the verification code. In July 2025, ZKSwap's bridge lost approximately $5 million because its on-chain verifier contract failed to actually check the zero-knowledge proofs, allowing the attacker to submit fake withdrawal proofs. The cryptography was sound, but the implementation was not.

Light Client Verification

Light client bridges run a lightweight version of the source chain's consensus verification on the destination chain. Rather than trusting external validators, the bridge contract directly verifies block headers and Merkle proofs from the source chain. IBC (Inter-Blockchain Communication), used across the Cosmos ecosystem, pioneered this approach. In April 2025, IBC Eureka extended trustless bridging to Ethereum using ZK proofs via Succinct's SP1 prover.

Rate Limiting and Circuit Breakers

Even with strong verification, operational safeguards can limit damage from undiscovered vulnerabilities. Rate limits cap the value that can be withdrawn in a given time window. Circuit breakers pause the bridge automatically when anomalous activity is detected. These controls would not have prevented the Ronin exploit (which went undetected for days), but they could have limited the damage from Nomad-style attacks where funds drained rapidly.

How Spark Avoids Bridge Risk

Spark takes a fundamentally different approach to scaling Bitcoin. Rather than bridging assets to a separate chain, Spark operates as a Layer 2 protocol natively on Bitcoin. Users' funds are held in virtual UTXOs (vTXOs) that remain secured by Bitcoin's base layer. There is no bridge contract holding pooled assets, no wrapped token that could become unbacked, and no validator set whose keys could be compromised to drain a shared pool.

This design eliminates the core vulnerability that bridge exploits target: the concentration of locked assets in a contract that depends on an external verification mechanism. With Spark, users retain self-custody of their Bitcoin and can exit to the base layer unilaterally. The security model inherits from Bitcoin itself rather than from an intermediary bridge.

For a deeper comparison of Bitcoin Layer 2 trust models, see the research article on Bitcoin L2 bridge security taxonomy.

Risks and Considerations

Bridge exploits remain one of the most significant risks in crypto. Users and developers should consider the following:

• No bridge design has proven immune to exploits. Even ZK bridges, which offer the strongest theoretical guarantees, can be undermined by implementation bugs in verification contracts.
• The amount of value at risk in bridges continues to grow as cross-chain activity increases. Higher TVL in bridge contracts means larger potential losses from a single exploit.
• Recovery from bridge exploits is rare. Unlike traditional finance, there is no insurance backstop or reversal mechanism for most bridge hacks. Some protocols have compensated users (Jump Crypto replaced Wormhole's losses), but this depends on the willingness and financial capacity of backers.
• Users should evaluate bridge security models before transferring significant value. Key questions include: how many independent signers are required, what verification mechanism is used, whether the code has been formally verified, and whether rate limits and circuit breakers are in place.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.