Trustless Bridge

What Is a Trustless Bridge?

A trustless bridge is a cross-chain bridge that allows assets or data to move between blockchains without requiring users to trust any intermediary. Instead of relying on a committee of signers to attest that a transaction occurred on the source chain, a trustless bridge uses mathematical verification: the destination chain independently confirms the source chain's state through cryptographic proofs.

The distinction matters because trusted bridges introduce a single point of failure. If the signing committee is compromised, whether through hacking, collusion, or coercion, user funds can be stolen. A trustless bridge eliminates this attack vector by deriving its security from the underlying blockchains' consensus mechanisms and the correctness of cryptography, not from the honesty of any group of people.

In practice, "trustless" exists on a spectrum. No bridge operates with zero trust assumptions: users still trust the correctness of smart contract code, the security of the underlying chains, and the liveness of relayers or provers. The term typically refers to bridges where verification is native (performed by the destination chain itself) rather than external (performed by a separate validator set).

How It Works

All bridges solve the same fundamental problem: proving to Chain B that something happened on Chain A. The mechanism for generating and verifying that proof is what separates trustless bridges from trusted ones.

Light Client Relays

The most conceptually straightforward approach: the destination chain runs a light client of the source chain. This light client verifies block headers and Merkle proofs to confirm that a specific transaction was included in the source chain's finalized state. Relayers carry data between chains, but they cannot forge messages because the receiving chain independently verifies every proof.

The Inter-Blockchain Communication (IBC) protocol, created by Cosmos, is the gold standard for this approach. Each participating blockchain maintains a light client of its peer chains. IBC connects over 120 Cosmos-based chains and, with the launch of IBC Eureka in April 2025, extended trustless bridging to Ethereum using ZK proofs via Succinct's SP1 prover. On-chain verification costs approximately 200,000 gas, a 25x reduction from naive header verification.

ZK Proof Verification

Zero-knowledge proof bridges compress the verification of a source chain's consensus into a succinct proof that can be cheaply verified on the destination chain. A prover generates a mathematical proof that a specific event occurred under the source chain's consensus rules, and the destination chain verifies this proof on-chain without replaying the full computation.

This approach has several variants:

• ZK light client proofs: prove that a set of validators signed a block header, verified inside a ZK circuit. Used by IBC Eureka and Polyhedra's zkBridge.
• ZK state proofs: verify specific facts about on-chain data (for example, "at block X on Chain A, address Y had balance Z") without proving full block finality.
• ZK consensus proofs: verify an entire chain's consensus finality mechanism inside a ZK circuit. The most comprehensive method, used by protocols like Union.

Polyhedra Network's zkBridge, first published as an academic paper at ACM CCS 2022, has generated over 40 million proofs across 25+ blockchains, with on-chain verification costing under 230,000 gas. For a deeper look at validity proofs and how they work, see our glossary entry.

Optimistic Verification with Fraud Proofs

Optimistic bridges take a different approach: relayers submit attestations that are accepted by default after a challenge window (typically 30 minutes to 7 days), unless a watcher posts a fraud proof during that period. Security requires at least one honest watcher to be online during every challenge window.

This model is sometimes called "trust-minimized" rather than fully trustless, because there is no on-chain way to verify that an honest watcher actually exists. The tradeoff is latency: withdrawals through optimistic verification can take days. Protocols like Across and the canonical bridges for optimistic rollups use this approach.

BitVM-Based Verification for Bitcoin

BitVM, proposed by Robin Linus in 2023, enables arbitrary computation verification on Bitcoin without requiring any protocol changes. It works through a challenge-response protocol: an operator makes a claim about a computation's result, and if the claim is false, any challenger can prove fraud on-chain using only existing Bitcoin opcodes and Taproot.

For bridges, this works as follows:

1. A user deposits BTC into a Taproot address controlled by the bridge
2. The corresponding Layer 2 mints equivalent tokens after confirmations
3. To withdraw, a user burns tokens on the L2 and an operator fronts BTC payment
4. The operator claims reimbursement after a challenge window (approximately 1.5 days)
5. If the claim is fraudulent, any challenger can initiate a dispute resolved on-chain

The trust model is 1-of-N honesty: only one honest participant is needed across three roles: one honest signer to prevent unauthorized fund movement, one honest watchtower to block invalid claims, and one rational challenger to prove invalid computation. This is a significant improvement over the honest-majority model of multisig bridges. For a detailed look at BitVM's verification mechanism, see our BitVM deep dive.

BitVM Evolution

BitVM has gone through three generations, each dramatically reducing on-chain costs:

BitVM3, published in May 2026, achieves a 46x reduction in assertion transaction size and reduces the disproval transaction to approximately 200 bytes. This makes trustless Bitcoin bridges economically viable for the first time.

Trusted vs. Trustless: Why Most Bridges Still Rely on Committees

Despite the advantages of trustless verification, the majority of bridge TVL still flows through trusted or trust-minimized systems. Several factors explain this gap:

• Engineering complexity: building and auditing light client verifiers or ZK circuits is significantly harder than deploying a multisig contract
• Proving costs: generating ZK proofs requires specialized hardware and adds latency, though costs are falling rapidly
• Chain compatibility: Bitcoin's script limitations make it impossible to run a light client verifier natively, requiring workarounds like BitVM
• Speed: trusted bridges can confirm in seconds, while optimistic bridges impose challenge windows measured in days

The cost of this reliance on trust has been severe. Between June 2021 and September 2024, over $4.3 billion was stolen across 49 bridge incidents, representing roughly 40% of all Web3 value hacked during that period. In 2022 alone, bridge exploits accounted for 69% of all crypto hack losses. For a comprehensive analysis of bridge security models, see our research on cross-chain bridging risks.

Notable Bridge Exploits

The largest bridge hacks illustrate why trustless verification matters:

• Ronin Bridge ($624M, March 2022): a 5-of-9 multisig where one entity controlled 4 keys plus a delegated 5th. Attackers compromised the keys through a phishing campaign.
• Wormhole ($320M, February 2022): a bug in signature verification allowed an attacker to bypass the guardian set entirely and mint 120,000 wETH.
• Harmony Horizon ($100M, June 2022): a 2-of-5 multisig where only 2 compromised keys were needed to drain all funds.

In each case, the attack exploited the trusted committee model. A ZK or light-client bridge has no private keys to compromise: verification is mathematical. The NEAR Rainbow Bridge demonstrated this concretely in 2022 when automated watchdog bots challenged fabricated block headers within 31 seconds, causing the attacker to lose their deposit instead.

The Bitcoin Challenge

Building trustless bridges to and from Bitcoin is fundamentally harder than on Ethereum. Bitcoin Script is intentionally not Turing-complete: it cannot natively verify complex proofs like ZK-SNARKs or run arbitrary smart contract logic. Ethereum's EVM can run a light client verifier contract directly; Bitcoin cannot.

Additional constraints include Bitcoin's stateless UTXO model (no persistent global state for a bridge contract to reference) and the absence of a native smart contract layer. These limitations explain why Bitcoin bridges have historically relied on federated models: Wrapped Bitcoin (wBTC) uses BitGo as a centralized custodian, and Liquid uses a 15-member federation of functionaries. For a comparison of these trust models, see our research on wrapped Bitcoin security models and Bitcoin L2 trust models.

BitVM circumvents these limitations by encoding arbitrary computations through an off-chain protocol with on-chain fraud proofs, using only existing Bitcoin opcodes and Taproot. Several projects are building on this foundation: Citrea's Clementine bridge uses BitVM2 for optimistic verification of ZK proofs directly on Bitcoin, with mainnet approaching as of mid-2025. BOB is implementing BitVM3 with further cost optimizations.

Use Cases

Cross-Chain Asset Transfers

The primary use case: moving assets between blockchains without trusting a custodian. Users can bridge BTC to a Layer 2 for faster and cheaper transactions, or move stablecoins between chains to access different DeFi protocols. Trustless bridges ensure that the bridged assets are always backed 1:1 by locked funds on the source chain, verified cryptographically.

Cross-Chain Messaging

Beyond simple asset transfers, trustless bridges enable verified communication between chains. A smart contract on Chain A can trigger actions on Chain B with cryptographic guarantees that the message is authentic. This underpins cross-chain governance, multi-chain DeFi protocols, and interoperability layers like IBC and Polymer.

Bitcoin DeFi

Trustless bridges are critical for the emerging BTCFi ecosystem. Without them, using BTC in DeFi requires trusting a custodian (like BitGo for wBTC) or a federation (like Liquid). BitVM-based bridges promise to let users access Layer 2 protocols and DeFi applications while maintaining Bitcoin's security guarantees. Spark's approach to stablecoin payments on Bitcoin similarly benefits from trust-minimized bridge infrastructure that preserves self-custody.

Risks and Considerations

Smart Contract Risk

Even trustless bridges rely on smart contract code for verification. Bugs in the verifier contract, the ZK circuit, or the light client implementation can be exploited regardless of the trust model. The Nomad Bridge lost $190 million in 2022 due to a bug where a routine upgrade caused all messages to be automatically deemed verified. Trustless bridges reduce but do not eliminate the bridge security attack surface.

Liveness Dependencies

Trustless bridges still depend on external actors for liveness. Light client bridges need relayers to forward block headers. ZK bridges need provers to generate proofs. Optimistic bridges need watchers to submit fraud proofs. If these actors go offline, the bridge may stall (though user funds typically remain safe). In the worst case for optimistic bridges, the absence of an honest watcher during a challenge window could allow a fraudulent withdrawal.

Proving Costs and Latency

ZK proof generation requires significant computational resources and adds latency to bridging operations. While costs are falling (IBC Eureka verifies for approximately 200,000 gas; BitVM3 disputes cost approximately $9), they remain higher than simple multisig attestations. This creates a tension between security and user experience that the industry is actively working to resolve.

Fundamental Limitations

Research has shown that truly trustless cross-chain communication is impossible without additional assumptions beyond the two underlying chains. Every bridge design introduces at least one external dependency, whether it is a relayer, prover, watcher, or the cryptographic assumptions underlying the proof system. Vitalik Buterin warned in 2022 that cross-chain bridges have "fundamental limits to security" because a 51% attack on one chain could cause systemic contagion across bridged assets.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.