Crypto Bridges: How Cross-Chain Transfers Work and the Risks

A bridge moves assets between blockchains by locking tokens on one chain and minting or releasing equivalents on another, and it is the most hacked category in all of crypto.

Crypto is not one network — it is many. Ethereum, Arbitrum, Solana, Base, and dozens of others each hold assets and host apps, but they cannot natively talk to each other. Bridges exist to connect them. They are also, by a wide margin, the most exploited part of the crypto ecosystem, with multi-billion-dollar hacks to their name. This guide explains how bridges work, the major designs, the history of breaches, and how beginners can move between chains while minimizing risk.

Why we need bridges

Every blockchain is an isolated ledger. ETH on Ethereum mainnet cannot be spent on Arbitrum, and USDC on Solana cannot be used on Base — even though the "same" token exists on each. Without bridges, you would have to sell on one chain, withdraw to fiat, and rebuy on another, paying fees and spreading risk across exchanges.

Bridges let you move assets directly between chains, which is essential because:

• Liquidity is fragmented across many networks
• Different dApps live on different chains
• Fees and speed vary enormously between chains
• Users want to follow yield and opportunities wherever they appear

The need is real. The danger is that bridges sit at the seam between chains, and that seam is where attackers focus.

How bridges work: the main designs

There are three broad approaches, each with a different trust model.

1. Lock-and-mint

The most common design. When you bridge ETH from Ethereum to a sidechain:

1. The bridge locks your ETH in a smart contract on Ethereum.
2. It mints an equivalent wrapped token (e.g., WETH) on the destination chain.
3. When you bridge back, the wrapped token is burned and the original ETH is released.

The wrapped token is a claim on the locked original. This design is used by many bridges, including the original Wrapped Bitcoin (WBTC) model. Its risk: if the locking contract or its validators are compromised, attackers can mint unbacked wrapped tokens.

2. Liquidity pool bridges

Instead of minting, the bridge maintains liquidity pools of real tokens on both chains. When you "bridge" USDC from chain A to chain B:

1. The bridge takes your USDC on chain A.
2. It pays you USDC out of its pool on chain B.

No wrapping is needed — you receive the real token. The trade-off is that the bridge operator must pre-fund pools on every supported chain, and large transfers can be limited by pool depth. Hop, Across, and Stargate use variants of this model.

3. Atomic swaps and burn-and-mint

Some bridges use atomic cross-chain swaps or native burn-and-mint (where a token is burned on one chain and minted on another by its own protocol). These can reduce trust assumptions but are more limited in which assets they support.

Mainstream bridges

Bridge	Style	Notes
Wormhole	Lock-and-mint, multi-validator	Connects many chains including Solana
LayerZero	Messaging + oracle/relay	Omnichain protocol powering many frontends
Hop	Liquidity pools	Fast L2-to-L2 transfers
Across	Liquidity pools, optimistic	L2-focused, low fees
Stargate	Omnichain liquidity	Built on LayerZero
Official L2 bridges	Lock-and-mint	Each L2's own bridge to Ethereum L1

For beginners moving between Ethereum and its Layer 2s, the official L2 bridges (Arbitrum, Optimism, Base) are the safest starting point because they inherit the most trust from the L2 itself.

A history of bridge hacks

Bridges hold enormous value locked at the seam between chains, which makes them the single most targeted category in crypto. Major incidents include:

• Ronin Network (2022) — attackers compromised validator keys and stole roughly $625 million, the largest crypto hack at the time.
• Wormhole (2022) — a smart-contract flaw was exploited for about $320 million.
• Nomad (2022) — a misconfigured initialization let essentially anyone copy a transaction and drain the bridge, leading to a rapid ~$190 million loss.
• Poly Network (2021) — over $600 million stolen (later largely returned by the attacker).
• Harmony's Horizon bridge (2022) — around $100 million lost to a validator-key compromise.

A clear pattern emerges: bridges fail through smart-contract bugs and through compromised validator/multisig keys. Both are real risks for users.

Bridge security models

Understanding a bridge's trust model helps you judge its risk:

• Validator/multisig-based — a set of off-chain validators sign transfers. Security depends on how many validators must agree and how decentralized they are. Fewer signers mean more centralization risk.
• Optimistic — transfers are assumed valid and can be challenged during a fraud window, similar to Optimistic Rollups.
• ZK-based — cryptographic proofs guarantee correctness, reducing trust in operators, though adoption is still growing.
• Native L2 bridges — secured by the L2's own mechanism, generally the closest to "trustless" for Ethereum L2s.

No bridge is risk-free. Even audited, well-funded bridges have been hacked.

How to evaluate bridge risk

Before using a bridge, ask:

• Is it the official bridge of an L2? If yes, prefer it for L1-to-L2 moves.
• What is the trust model? Multisig with few signers is riskier than optimistic or ZK designs.
• Has it been audited? By which firms? Are audits public?
• How much total value does it hold? Very small bridges may be unaudited or short-lived.
• How long has it operated without incident? Track record matters.
• Is the frontend official? Fake bridge frontends are a top phishing vector.

A beginner's step-by-step cross-chain transfer

1. Use the official bridge whenever moving between an L1 and its own L2.
2. Verify the URL by typing it or using an official bookmark.
3. Bridge a small test amount first to confirm the flow works.
4. Confirm the destination network in your wallet before sending.
5. Wait for finality — some bridges take minutes; Optimistic L2 withdrawals to L1 take about a week.
6. Keep amounts modest — minimize the value sitting in a bridge at any time.
7. Prefer well-known, high-liquidity bridges (Hop, Across, Stargate) for L2-to-L2 moves.

Minimizing risk: practical rules

• Bridge only what you need — do not move your entire stack at once.
• Prefer official L2 bridges for Ethereum L2 access.
• Avoid brand-new, unaudited bridges regardless of promised speed or rewards.
• Do not leave funds on a bridge longer than necessary.
• Diversify — for large cross-chain needs, consider splitting across more than one reputable bridge.
• Treat bridges as the riskiest leg of any transaction — the destination chain may be safe, but the transit is not.

Bottom line

Bridges are essential plumbing for a multi-chain crypto world, and they are also its weakest security link. History shows that even high-profile bridges can be drained overnight. For beginners, the safest approach is to use official L2 bridges, move small amounts, verify every URL, and never let more value sit in transit than you can afford to lose. The convenience of cross-chain transfers is real — but so is the risk.

This article is for educational purposes only and does not constitute financial advice. Cross-chain bridges involve significant risk, including total loss of transferred assets; always do your own research and never bridge more than you can afford to lose.