TechExplainer

What is a cross-chain bridge, and why are bridges such a target for hackers?

Blockchains cannot talk to each other on their own. Bridges fill the gap by locking, minting and burning tokens, and in doing so they concentrate a lot of value in one place.

By the Bitfolio Explainer Desk · Checked against primary sources · 7 min read

A lit suspension bridge spanning a river at night — Photo: “Roebling Suspension Bridge at night” by EEJCC, CC BY-SA 4.0, via commons.wikimedia.org · Edited: duotone, cropped.

The short answer

A cross-chain bridge is a system that moves tokens or messages from one blockchain to another. Most bridges lock or burn tokens on the source chain and mint matching tokens on the destination chain, so whoever controls the locked funds or the minting rules holds a lot of power.

Key takeaways

Blockchains run separately and cannot read each other's records, so bridges carry assets and messages between them.
The main methods are lock and mint, burn and mint, and atomic swaps; a token you receive may be a wrapped copy rather than the original asset.
Trusted bridges rely on outside operators to hold funds or confirm transfers; trustless bridges rely on smart contracts and the underlying chains.
Bridges hold large pools of locked assets, which makes them attractive targets: the FBI linked a 100 million dollar bridge theft in 2022 to North Korean hackers.
If a bridge's locked funds are stolen, the wrapped tokens it issued on other chains can lose their backing.

What is a cross-chain bridge?

A bridge lets blockchains communicate by transferring information and assets between them¹. Each blockchain keeps its own ledger with its own rules, and none can natively read another's records¹: Bitcoin cannot see Ethereum, and Ethereum cannot see Bitcoin. The U.S. Treasury describes bridges in the same terms: they let users move virtual assets or information from one blockchain to another³.

People use bridges to reach apps on another chain, to move ether from Ethereum onto a layer 2 rollup such as Arbitrum through its native bridge¹, or to use an asset like bitcoin in Ethereum-based DeFi. A U.S. government overview of token design notes that a blockchain connected to another through a two-way bridge is sometimes called a sidechain⁴.

How does a bridge move tokens from one chain to another?

A token cannot literally leave its home chain. Instead, bridges use one of three methods²:

The three ways bridges transfer value Source: [2]

Method	On the source chain	On the destination chain
Lock and mint	Your tokens are locked in a bridge contract	An equal amount of new, wrapped tokens is minted
Burn and mint	Your tokens are destroyed (burned)	Fresh tokens are minted
Atomic swap	You trade your tokens with another party	You receive that party's tokens

Figure · Lock and mint, step by step

01You send tokensto the bridge on Chain A
02Tokens lockedheld by a bridge contract
03Transfer verifiedby contracts or operators
04Wrapped tokens mintedcredited to you on Chain B

The wrapped token is only as good as the bridge holding the originals. Source: [2]

The result of lock and mint is a wrapped token: a stand-in that represents the locked original. Wrapped bitcoin (WBTC), for example, is a version of bitcoin that lives on Ethereum¹. Atomic swaps work differently. Two people exchange tokens directly without a custodian, using cryptographic hash locks and time locks so that either both sides of the trade happen or neither does⁴.

What kinds of bridges are there?

Ethereum's developer documentation sorts bridges into four broad groups²:

Four common bridge designs (examples as listed by ethereum.org) Source: [2]

Type	What it does	Examples
Native bridges	Built by a chain to bring in liquidity from another	Arbitrum Bridge, Optimism Gateway
Validator or oracle based	External validators or oracles confirm transfers	Multichain, Across
Generalised message passing	Carries assets, messages and arbitrary data	Axelar, LayerZero, Nomad
Liquidity networks	Moves assets through atomic swaps; no messages	Connext, Hop

What is the difference between trusted and trustless bridges?

The most important question about any bridge is who you have to trust. A trusted bridge depends on a central entity or outside verifiers to operate, and users hand over control of their assets while they are in transit¹. These designs tend to be fast and well connected, at the cost of security². A trustless bridge relies on smart contracts and the validators of the underlying chains, adding no new trust assumptions², so users keep control of their funds¹.

Figure · Trusted and trustless bridges

Trusted bridge

Outside operators verify transfers
Users give up custody in transit
Fast, links many chains
Operators can censor or steal

Trustless bridge

Smart contracts verify transfers
Users keep control of funds
Security close to the base chains
Often slower or fewer chains

Source: [2]

Why are bridges a favourite target for hackers?

A lock-and-mint bridge keeps a large store of locked tokens in one place, and its code or its operators decide when those tokens are released. Break that logic, or steal the keys that approve releases, and the store can be emptied. IOSCO, the global body for securities regulators, said in 2023 that DeFi's reliance on cross-chain bridges continues to present considerable risks⁵.

One case shows the key-theft risk. The Treasury reports that on 23 March 2022 the Lazarus Group, a sanctioned North Korean state-sponsored hacking group, stole almost 620 million dollars from a blockchain project linked to the game Axie Infinity³. That project's own post-mortem says the attacker gained five of the nine validator keys that approve releases and drained 173,600 ether and 25.5 million USDC from the Ronin bridge⁷. The FBI said that North Korea-linked hackers known as the Lazarus Group and APT38 stole 100 million dollars of virtual currency from Harmony's Horizon bridge on 24 June 2022, and later laundered more than 60 million dollars of the stolen ether through a privacy protocol⁶. The Treasury reported that more than 96 million dollars from the Harmony theft and at least 7.8 million dollars from the 2 August 2022 Nomad heist were laundered through the Tornado Cash mixer³. Our page on sanctions and crypto covers how governments respond.

Figure · Bridge thefts and official responses

23 Mar 2022Ronin bridge drained via 5 of 9 keys
24 Jun 2022Horizon bridge theft, 100 million dollars
2 Aug 2022Nomad heist
23 Jan 2023FBI names Lazarus Group for Horizon
Apr 2023Treasury DeFi risk assessment
Dec 2023IOSCO flags bridge risk

Ethereum's documentation lists the main bridge risks: bugs in smart contracts, systemic risk when wrapped assets are exploited, counterparty risk in trusted designs, including operators censoring users or running off with funds, and open questions about how bridges behave under network stress². The systemic point matters even for holders who never used the bridge themselves: a wrapped token is only as sound as the store of originals behind it².

Risk warning

Bridged tokens carry extra risk

When you hold a wrapped token you are exposed to the asset's price and to the bridge that issued it. Stolen funds may never be recovered, and crypto-assets are highly volatile. Read our risk disclosure before moving funds.

What mistakes do people make when bridging?

Common beginner mistakes

Assuming a wrapped token is the real thing
WBTC on Ethereum is not bitcoin. It is a claim backed by bitcoin held elsewhere, and its value depends on that backing staying intact.
Not knowing who runs the bridge
Find out whether transfers are confirmed by smart contracts or by a small group of operators who could be hacked or act dishonestly.
Using a link from an ad or a direct message
Phishing is a common way attackers get into accounts and wallets³. Type the bridge's address yourself or follow the chain's official documentation.
Sending everything at once
Try a small test transfer first and confirm it arrives before moving larger amounts.
Forgetting about approvals
Bridges ask permission to move your tokens. Review and remove approvals you no longer need, as explained in our guide to wallets and keys.

Frequently asked questions

Is a bridge the same as an exchange?

No. An exchange swaps one asset for another. A bridge moves value from one blockchain to another, usually so you hold a version of the same asset on a different chain¹. Some liquidity-network bridges use swaps under the hood².

What happens to my original tokens when I bridge?

With lock and mint, they sit in a bridge contract on the original chain while you hold wrapped tokens elsewhere. With burn and mint, they are destroyed and new ones are created on the destination chain².

Are native rollup bridges safer?

Native bridges are built by the chain itself to move assets in and out². How much you must trust them depends on the design, so check whether a rollup's bridge relies on proofs or on a set of operators.

Who was behind the biggest bridge thefts?

U.S. authorities attributed the 2022 Horizon bridge theft to the North Korea-linked Lazarus Group and APT38⁶. Attribution of other incidents varies from case to case.

Can stolen bridge funds be recovered?

Sometimes, in part. The FBI said a portion of the stolen Horizon funds was frozen with the help of virtual asset service providers⁶. Recovery is not something users can count on.

The bottom line

Bridges are the connectors of a world with many separate blockchains, and they work by locking, burning and minting tokens or by swapping them. That design concentrates large pools of value behind a small amount of code or a small set of operators, which is what attackers in the thefts documented by U.S. authorities went after. Know which bridge issued any wrapped token you hold, and who you are trusting when you cross.

Sources

Blockchain bridges — ethereum.org (Ethereum Foundation) Primary source
Bridges (developer documentation) — ethereum.org developer documentation Primary source
Illicit Finance Risk Assessment of Decentralized Finance — U.S. Department of the Treasury, 2023 Primary source
NISTIR 8301: Blockchain Networks: Token Design and Management Overview — National Institute of Standards and Technology, 2021 Primary source
Final Report with Policy Recommendations for Decentralized Finance (DeFi) — International Organization of Securities Commissions (IOSCO), 2023 Primary source
FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft — Federal Bureau of Investigation, 2023 Primary source
Back to Building: Ronin Security Breach Postmortem — Ronin (Sky Mavis), 2022 Primary source

How we checked this page: every figure above links to the numbered source it came from. Spotted an error? Tell the desk — see our editorial policy.