Bridge Hacks: The Mechanism They All Share Across the Biggest Incidents

A cross-chain bridge exists because two blockchains cannot read each other. The common design locks a real asset on the source chain and issues a representative token on the destination chain, then burns the representation and releases the original on the way back. The locked side holds the money. The issued side holds only a claim that something was locked. Every large bridge theft of the past five years is an attack on the machinery that decides whether that claim is true.

This article is a factual reference on how those attacks work and does not constitute investment or financial advice. It also tries to be honest about the limits of the record. Loss figures for bridge incidents are revised repeatedly, the strongest public descriptions of several incidents come from the victims or their security vendors rather than from courts or regulators, and the measured evidence that any particular defence works is thin.

What does a cross-chain bridge do, and why does that make it a target?

A bridge concentrates value in one place and then protects it with a verification rule, which is exactly the shape an attacker wants. Chainalysis made the point plainly in August 2022: "Bridges are an attractive target because they often feature a central storage point of funds that back the bridged assets on the receiving blockchain," and "regardless of how those funds are stored, locked up in a smart contract or with a centralized custodian, that storage point becomes a target."

The verification rule is where the variation lives. Some bridges ask a fixed set of validators to sign a withdrawal. Some verify a cryptographic proof of a source-chain state. Some watch for a deposit event and mint on trust. The academic literature treats these as distinct attack surfaces rather than one risk. The systematisation by Mengya Zhang and co-authors, published as arXiv:2312.12573 and at the RAID 2024 symposium, identifies 12 attack vectors and sorts observed attacks into 10 vulnerability types grouped as permission issues, logic issues, event issues and front-end issues. A separate peer-reviewed systematisation from the Norwegian University of Science and Technology, arXiv:2403.00405 by Notland and co-authors, uses eight categories including private key leak, authentication bypass, fraudulent proof, bad business logic and malicious contract event.

Both papers reach the same uncomfortable conclusion about architecture rather than coding. As the NTNU paper puts it, "the findings demonstrate many single-key and single-entity-operated bridges, which is a high-risk liability."

How much has actually been lost, and how reliable are the totals?

The honest answer is that headline figures are upper bounds and the realised losses are often much smaller. Chainalysis estimated on 2 August 2022 that roughly 2 billion dollars had been stolen across 13 cross-chain bridge hacks, and that attacks on bridges accounted for 69 per cent of all funds stolen in crypto that year to date. That 69 per cent is a share of a single year during the worst run of bridge incidents on record, not a permanent property of bridges, and it should not be quoted as a general statistic.

Valuation timing alone moves the numbers by hundreds of millions. Elliptic, writing on 29 March 2022, put the Ronin theft at 173,600 ETH and 25.5 million USDC, worth about 540 million dollars when taken on 23 March 2022 and more than 615 million dollars by the time it was noticed six days later. Later coverage commonly cites 620 to 625 million dollars for the same event.

Verified major bridge incidents, headline loss against what moved

Incident	Date	Headline loss	What is documented about the outcome	Mechanism family
Poly Network	10 Aug 2021	611m USD	Split 273m on Ethereum, 253m on BNB Smart Chain, 85m on Polygon, returned over the following weeks	Permission and access control
Qubit QBridge	27 Jan 2022	80m USD	Minted representative tokens against deposits that never arrived	Fake deposit event
Wormhole	2 Feb 2022	120,000 wETH, about 320m USD	Solvency restored by the parent firm replacing the ETH, users not made to absorb it	Signature verification bug
Ronin	23 Mar 2022, found 29 Mar	540m USD at the time, 615m+ at discovery	OFAC added a linked Ethereum address to the sanctions list on 14 Apr 2022	Validator key compromise
Harmony Horizon	24 Jun 2022	About 100m USD	US Treasury records more than 96m USD of it laundered through Tornado Cash	Multisig key compromise
Nomad	1 to 2 Aug 2022	About 190m USD	Treasury dates it 2 Aug and traces at least 7.8m USD through Tornado Cash, one defendant later indicted over 2.89m	Initialisation and proof logic
BNB Token Hub	6 to 7 Oct 2022	2m BNB, about 566m USD	About 110m USD moved off the chain, roughly 430m USD stranded after 26 validators halted the network	Forged Merkle proof
Multichain	6 Jul 2023	More than 125m USD	Contested as hack or insider action, the team said it had lost the platform MPC keys after the chief executive was detained	Single-entity key control
Kelp DAO on LayerZero	18 Apr 2026	116,500 rsETH, about 292m USD	Core contracts paused 46 minutes later, two further attempts blocked, attributed to DPRK actors	Verifier infrastructure poisoning

The BNB row is the clearest warning against reading headlines as losses. Two million BNB were conjured, which the press valued near 566 million dollars, but security firm SlowMist tracked only about 110 million dollars leaving the chain before validators cooperated to stop block production, and roughly 430 million dollars sat immobilised in the attacker wallet. A bridge theft is only as large as the exit, and exits can be closed by the very centralisation that people criticise.

Which failure mechanisms keep repeating?

Three mechanisms account for nearly every large incident, and the fourth is the first one approached from a different angle. The first is control of the signing quorum. The second is a flaw in how the destination chain verifies a message. The third is trusting an event on the source chain that does not mean what the bridge thinks it means. The fourth, visible in 2026, is poisoning the data a verifier reads instead of stealing the verifier key.

Mechanism families mapped to the academic taxonomies

Mechanism family	What the attacker needs	Zhang et al. category	Notland et al. category	Worked example
Quorum or key compromise	Enough signing keys to meet the threshold, usually obtained off chain	Leaked key permission	Private key leak	Ronin, Harmony, Multichain
Verification logic bug	A code path that accepts an unproven message as proven	Invalid signature permission, inaccurate initialisation logic	Authentication bypass	Wormhole, Nomad
Privilege confusion	A privileged contract that can be made to call its own registry	Unchecked intermediary permission	Privilege escalation	Poly Network
Forged or replayed proof	A proof format that can be shortened, collided or reused	Misused proof permission	Fraudulent proof, replay	BNB Token Hub, Wanchain 2026
Fake deposit event	A deposit call that emits a success event without moving value	Incorrect or fake event emission	Bad business logic, malicious contract event	Qubit QBridge
Verifier data poisoning	Control of the nodes a verifier queries, plus pressure on the honest ones	Not separately categorised in the 2023 taxonomy	Not separately categorised in the 2024 taxonomy	Kelp DAO on LayerZero

The last row matters because it is new. Both systematisations were written before 2026 and neither anticipates an attack that leaves keys, contracts and quorum rules untouched and instead corrupts what the honest signer sees. A taxonomy is a record of past attacks, not a forecast of the next one.

How does a key or quorum compromise actually unfold?

It begins with people, not contracts, and the threshold is usually the first thing someone quietly weakened. Ronin ran nine validators and released funds on five approvals, per Elliptic's account. Four of those validator keys sat with the operator. The fifth came from a third-party validator that had granted the operator signing permission months earlier for convenience and never revoked it, so compromising one organisation produced a lawful-looking five-of-nine approval.

Harmony's Horizon bridge was reported to need only two of five signatures, which converts a multisig from a safeguard into a two-person single point of failure. Multichain is the extreme case. Chainalysis reported on 10 July 2023 that more than 125 million dollars left Multichain custody addresses, that the chief executive had become unreachable on 31 May 2023, and that the team said it had lost the platform MPC keys after his detention. Chainalysis also recorded that many analysts considered the event an inside job or rug pull rather than an intrusion, and did not resolve the question.

The initial access route is better documented at the level of technique than per incident. A joint advisory from the FBI, CISA and the US Treasury, numbered AA22-108A and revised 20 April 2022, describes North Korean operators sending "a large number of spearphishing messages" to employees of cryptocurrency firms, often in system administration or development roles, where "the messages often mimic a recruitment effort and offer high-paying jobs" leading to malware-laced applications the US government calls TraderTraitor. That advisory never names Ronin or Sky Mavis, so the widely repeated fake job offer story for that specific bridge rests on the company account and press reporting rather than on a government document. The same pattern reappears in 2026. LayerZero's own post-mortem, as reported by The Defiant and summarised by Chainalysis, traces the Kelp DAO loss to a developer who cloned a malicious repository on 6 March 2026, six weeks before anything was stolen.

Government records do carry the attribution and the money trail. The Office of Foreign Assets Control updated the Lazarus Group entry on 14 April 2022 and listed the Ethereum address 0x098B716B8Aaf21512996dC57EB0615e2383E2f96. The Treasury press release of 8 August 2022 designating Tornado Cash states that the mixer was used to launder "over 455 million dollars stolen by the Lazarus Group," "more than 96 million dollars of malicious cyber actors funds derived from the June 24, 2022 Harmony Bridge Heist" and "at least 7.8 million dollars from the August 2, 2022 Nomad Heist." Those are primary figures from a sanctions authority, which is a stronger footing than any vendor estimate, although they measure laundering flows rather than total theft. This is the same custody question that regulated institutions are now being asked to answer, discussed in our coverage of the FDIC approval for banks to hold bitcoin in custody.

Why do verification bugs let an attacker mint without any key?

Because a bridge does not check whether a message is true, it checks whether a proof passes, and a proof is just code. Wormhole lost 120,000 wETH on 2 February 2022 without any guardian key being stolen. Halborn's technical write-up describes a contract that "used a deprecated command called load_instruction_at to ensure that Secp256k1 was called previous to verify_signatures," while that function failed to validate the address of the Instructions sysvar. The attacker supplied a fabricated account in its place, the check passed in the wrong context, and a forged SignatureSet produced a valid attestation that minted real tokens.

Nomad is the same shape with a simpler cause. Halborn reports that a protocol upgrade initialised the trusted root to 0x00, the default value the Replica contract already used for unproven messages, with the result that "all messages are automatically viewed as proven." Exploiting it required no understanding at all, since "exploiting it simply required taking a successful exploit transaction and submitting it with their own account address," which is why roughly 190 million dollars left in a crowd rather than a heist. The legal tail is long. US prosecutors in the Northern District of California later brought an eight-count indictment against Alexander Gurevich over about 2.89 million dollars taken as the first exploiter, and he was arrested in Israel in May 2025 pending extradition, which is reported detail rather than something we read in a court docket.

Poly Network shows how fast a confident explanation can be wrong. The Block reported on 10 August 2021 that 611 million dollars had been taken across three chains and quoted an analyst suggesting a cryptographic cause, possibly a reversed private key. The settled account is different. The cross-chain manager contract held authority over the keeper registry, so crafted call data could reach the function that replaces the keeper public keys and install an attacker-controlled keeper, after which otherwise ordinary withdrawals verified correctly. The Zhang taxonomy files it as unchecked intermediary permission, a permission flaw, not a cryptography flaw. Day-one reporting on a bridge exploit is frequently superseded, and anything time-sensitive should be read against a later technical classification.

BNB Token Hub belongs here too. The Register reported on 7 October 2022 that two million BNB were created through what BNB Chain described as "a sophisticated forging of the low level proof into one common library," a flaw in the IAVL Merkle proof verification that let the attacker present a proof for an old block. No key was stolen and no validator misbehaved. The proof format simply accepted something it should have rejected.

What is a fake deposit event, and why does a bridge believe it?

A fake deposit event is a deposit that reports success while moving nothing, and a bridge believes it because the event is the only thing the other chain can see. Qubit's QBridge lost about 80 million dollars on 27 January 2022 in the cleanest example on record. Halborn's analysis explains that the deposit path called a modified transfer helper using a raw call rather than a library that checks for contract code, and that against the zero address "the 0 address has no code at all, no code is run, and the call is completed successfully without reverting." The deposit function returned successfully with no value attached, the bridge saw the Deposit event, and representative tokens were minted on the other chain against nothing. Repeating the call built a position that was then sold.

The 2026 variant is a replay rather than a fabrication. Reporting on the Wanchain bridge between Cardano and BNB Chain in July 2026 describes roughly 515 million NIGHT tokens, worth about 10 to 13 million dollars depending on the outlet, extracted because the signed payload concatenated multiple variable-length fields without delimiters, allowing different field values to hash identically and a legitimate authorisation to be reused with a different recipient. That incident is carried only by trade press and the bridge operator's own statement, so treat the mechanism as plausible and the figure as unsettled.

Did anything change after 2022?

Bridges stopped being the dominant target, but not because the mechanism was solved. Chainalysis reported on 19 December 2024 that 2.2 billion dollars were stolen across the crypto ecosystem in 2024, up about 21 per cent year on year across 303 incidents against 282 in 2023, and that "private key compromises accounted for the largest share of stolen crypto in 2024, at 43.8 per cent." The following report, dated 18 December 2025, put theft at more than 3.4 billion dollars from January to early December 2025, with the Bybit exchange compromise alone accounting for about 1.5 billion dollars, and noted that North Korean actors showed heavy reliance on cross-chain bridges to move assets and complicate tracing. Bridges had become the laundry as much as the target.

Then April 2026 produced the largest DeFi loss of the year through a bridge again. Chainalysis published on 23 April 2026 that attackers linked to the DPRK Lazarus Group, specifically the TraderTraitor subgroup, took about 292 million dollars or 116,500 rsETH from Kelp DAO on 18 April 2026. Two LayerZero-hosted RPC nodes had been compromised to return forged chain state, a denial of service attack pushed the signing service onto those nodes, and the configuration verified messages through a single verifier with no independent check. The emergency pause landed 46 minutes later and blocked two further attempts.

The post-incident argument is itself instructive and unresolved. LayerZero's post-mortem said Kelp had ignored repeated recommendations to move off a single-verifier configuration. Kelp replied, as reported by Unchained on 21 April 2026, that the single-verifier setup "was LayerZero's own documented default," that no specific recommendation to change the rsETH configuration had been made despite a channel open since January 2024, and that the compromised verifier was part of LayerZero's own infrastructure. An independent developer reviewing the framework's quickstart templates supported the claim about defaults. Where a bridge is assembled from a provider's defaults, the question of who owned the risky setting is not a detail, and in this case it is still disputed. Chainalysis drew the structural lesson instead: "quorum design is security design," and "bridges are, by definition, two-sided systems. Their correctness cannot be evaluated by looking at one chain in isolation."

How strong is the evidence behind each claim here?

Several claims in this article are well evidenced and several are not, so here they are scored against the source that actually carries them. Nothing in the table is softened to make the piece look better.

Claim-by-claim evidence strength for this article

Claim	Evidence type	Strength	Why
Three mechanism families cover most large losses	Two peer-reviewed systematisations plus incident records	Strong	Independent taxonomies converge on the same groups
Tornado Cash laundered 96m from Harmony and 7.8m from Nomad	US Treasury designation notice	Strong	Primary document from a sanctions authority
Lazarus Group is tied to a Ronin-linked address	OFAC sanctions entry plus analytics attribution	Moderate	OFAC lists the address but does not name the bridge in that entry
The Ronin intrusion began with a fake job offer	Company account and press, technique corroborated by advisory AA22-108A	Weak to moderate	The advisory describes the technique and never names the victim
Technical root causes of Wormhole, Nomad and Qubit	Security vendor post-mortems, not primary sources	Moderate	Consistent across vendors and matched to academic categories, but vendor-authored
Bridges were 69 per cent of funds stolen	Single analytics firm, partial-year 2022	Weak as a general statistic	True only for that window and never reproduced independently
Headline losses overstate realised losses	BNB chain-halt reporting and the Wormhole recapitalisation	Moderate	Two clear cases, no systematic dataset of recovery rates
Who chose the single-verifier setting at Kelp DAO	Two conflicting operator statements	Unresolved	Both parties are interested, no neutral finding exists yet
Wanchain 2026 hash-collision replay	Trade press and operator statement	Weak	No audit, indictment or peer-reviewed analysis available
Any named defence measurably reduces losses	Expert recommendation only	Weak	No controlled study, no counterfactual, survivorship bias likely

What actually reduces the risk, and what is still unproven?

The published recommendations are sensible and almost entirely untested at the level of measured effect. The NTNU systematisation groups them into prevention, including a "proper multi-signature scheme and multi-factor authentication," verifying the privilege of source and destination addresses, and ensuring call data uniqueness to defeat replay, and impact reduction, including maximum transfer limits, pause and freeze capability, longer fraud windows, validator intervention and asset freezing by exchanges.

The impact-reduction half has visible real-world support. BNB Chain stranded roughly 430 million dollars by halting block production. Kelp DAO's pauser cut off two further attempts within an hour. Stablecoin issuers froze attacker balances after the BNB incident, which is a reminder that the freeze powers now being written into law, covered in our piece on US Treasury stablecoin guidelines, are part of bridge security whether or not anyone designed them that way.

The prevention half is where claims outrun evidence. No public dataset shows that bridges with larger quorums suffer fewer or smaller incidents once you control for how much value they hold and how long they have been live. Audits did not catch the Nomad initialisation value or the Wormhole sysvar check. Moving from one verifier to several raises the cost of an attack but does nothing about an attacker who poisons the inputs every verifier reads, which is precisely what happened in April 2026. Anyone who tells you a particular bridge architecture is safe is making an engineering argument, not presenting evidence, and the honest version of that claim is that the failure modes have been made more expensive.

For readers weighing exposure rather than engineering, the relevant point is that representative tokens inherit the operational risk of the machinery that issues them, a problem shared with other wrapped and fractionalised claims examined in our analysis of fractional NFTs as an investment vehicle. The capital treatment of that kind of exposure is also unsettled, as set out in our coverage of Basel III crypto capital requirements. None of this is a recommendation to buy, hold or avoid any asset or protocol.

Frequently asked questions

Are bridge hacks mostly smart contract bugs or stolen keys?

Both, and the mix has shifted. The largest single-event losses on the list come from stolen or over-concentrated signing authority at Ronin, Harmony and Multichain, while Wormhole, Nomad, Poly Network and BNB Token Hub were code and proof failures with no key theft at all. Across the whole crypto market rather than bridges alone, Chainalysis attributed 43.8 per cent of 2024 losses to private key compromise, the largest single category.

Why does the same bridge hack get quoted at different dollar amounts?

Because the figures are measured at different moments and against different things. Ronin was about 540 million dollars when the assets moved on 23 March 2022 and more than 615 million dollars when the theft was discovered six days later. BNB Token Hub is quoted at 566 million dollars of minted tokens but only around 110 million dollars actually left the chain. Always ask whether a number is notional, moved or unrecovered.

Did anyone go to prison for a bridge exploit?

Prosecutions exist but they are slow and rare relative to the number of incidents. US prosecutors indicted a defendant in the Northern District of California over the first Nomad exploit transaction of roughly 2.89 million dollars, and he was arrested in Israel in May 2025 pending extradition. For state-linked thefts the practical response has been sanctions and attribution, such as the OFAC listing of a Lazarus-linked Ethereum address in April 2022, rather than arrest.

Is a multisig bridge safer than a validator-set bridge?

Not inherently, because what matters is the threshold and whether the signers are genuinely independent. Harmony's bridge reportedly needed two of five signatures. Ronin needed five of nine, but four keys sat with one company and a fifth had been delegated to it and never withdrawn, so a single intrusion met the threshold. A high ratio over signers who share infrastructure, staff or a hosting provider is not a high threshold.

Does using a proof-based or light-client bridge remove the risk?

It changes the risk rather than removing it. BNB Token Hub verified a Merkle proof and lost two million BNB to a forged one. Wanchain's 2026 incident involved a signed payload format that allowed a valid authorisation to be reused. Proof systems move the target from key custody to the correctness of the verification code and the data the verifier is fed.

What single question is most diagnostic about a bridge?

Ask what the quorum really is and who controls the inputs the quorum reads. The 2026 Kelp DAO loss was executed through a single-verifier configuration whose data feeds were poisoned weeks in advance, with no contract bug and no stolen signing key. As Chainalysis put it after that incident, "quorum design is security design."

Sources

• OFAC Recent Actions, 14 April 2022, North Korea designations update listing the Lazarus Group and Ethereum address 0x098B716B8Aaf21512996dC57EB0615e2383E2f96. Primary government record.
• US Department of the Treasury press release, 8 August 2022, sanctioning the virtual currency mixer Tornado Cash. Primary source for the Harmony and Nomad laundering figures.
• Joint FBI, CISA and Treasury advisory AA22-108A, TraderTraitor, North Korean State-Sponsored APT Targets Blockchain Companies, revised 20 April 2022. Primary source for the social engineering technique, no named victims.
• Zhang, Zhang, Barbee, Zhang and Lin, SoK: Security of Cross-chain Bridges, Attack Surfaces, Defenses, and Open Problems, arXiv:2312.12573, 19 December 2023, also RAID 2024. Peer-reviewed taxonomy.
• Notland, Li, Nowostawski and Haro, SoK: Cross-Chain Bridging Architectural Design Flaws and Mitigations, arXiv:2403.00405, 1 March 2024. Peer-reviewed taxonomy and mitigation list.
• Lee, Murashkin, Derka and Gorzny, SoK: Not Quite Water Under the Bridge, Review of Cross-Chain Bridge Hacks, arXiv:2210.16209, 28 October 2022. Preprint, authors industry-affiliated.
• Chainalysis, Cross-Chain Bridge Hacks Emerge as Top Security Risk, 2 August 2022. Analytics firm estimate, partial-year figures.
• Chainalysis, 2.2 Billion Stolen in Crypto in 2024 but Hacked Volumes Stagnate, 19 December 2024. Analytics firm estimate.
• Chainalysis, 2025 Crypto Theft Reaches 3.4 Billion, 18 December 2025. Analytics firm estimate.
• Chainalysis, Inside the KelpDAO Bridge Exploit, 23 April 2026. Analytics firm account, relies in part on the LayerZero post-mortem.
• Chainalysis, Multichain Exploit, Possible Hack or Rug Pull, 10 July 2023. Analytics firm account, cause unresolved.
• Elliptic, 540 Million Stolen from the Ronin DeFi Bridge, 29 March 2022, updated 14 April 2022. Analytics firm account.
• The Block, At Least 611 Million Stolen in Massive Cross-Chain Hack, 10 August 2021. Contemporaneous trade press, its suggested cause was later superseded.
• The Register, Binance Bridge Hack Siphons About 566 Million of BNB Tokens, 7 October 2022. Trade press, carries the chain-halt and off-chain movement figures.
• Unchained, Kelp DAO Disputes LayerZero's Account of the 290 Million Exploit, 21 April 2026. Trade press reporting two conflicting operator statements.
• Halborn, Explained, The Wormhole Hack, February 2022. Security vendor post-mortem, not a primary source.
• Halborn, Explained, The Nomad Hack, August 2022. Security vendor post-mortem, not a primary source.
• Halborn, Explained, The Qubit Hack, January 2022. Security vendor post-mortem, not a primary source.

Further reading on adjacent market structure questions includes our coverage of ESG crypto funds and sustainable digital asset trends. This article is a technical reference and does not constitute investment or financial advice.