Crypto bridges move tokens and data between blockchains that cannot communicate on their own, and they have become one of the most heavily attacked components of the crypto industry. A 2026 guide to blockchain bridges puts cumulative losses from bridge exploits above $4.3 billion since 2021, and bridges accounted for two of the three largest DeFi exploits in the first quarter of 2026. This article breaks down how bridges operate, how much has been lost, and what the record shows about their weaknesses.

What Is a Crypto Bridge?

Blockchains such as Bitcoin, Ethereum and BNB Smart Chain each operate under their own rules, with distinct consensus mechanisms, programming languages and token standards. By default, none of them can send messages or assets to another chain.

A crypto bridge is a protocol that connects two separate blockchain networks, allowing users to move assets or data from one chain to the other. This capability is known as interoperability.

Explainers frequently use the image of a physical bridge between two islands: each island is its own blockchain ecosystem, and without a bridge, assets and users remain stuck on their island.

Crossing serves practical purposes. Users can reach applications and DeFi services that exist only on another chain, and because transaction fees vary between networks, some users shift assets to a cheaper chain for particular transactions.

Developers benefit as well, since bridges let them build applications that draw on the strengths of several blockchains at once. Curve Finance and Aave, for instance, use bridges to let users move liquidity between Ethereum and networks such as Polygon and Avalanche.

The alternative — selling an asset and buying a new one — carries transaction costs and exposes the user to price swings. A bridge lets the user retain the original asset while gaining access to a new network.

Usage figures underline how heavily people depend on bridges. Chainalysis reported that monthly bridged volume in 2024 ranged from $1.5 billion to $3.2 billion.

How Crypto Bridges Move Value

Most bridges transfer value through a lock-and-mint process. The user sends the original token to a bridge contract on the source chain, which locks the token and records the deposit. The bridge then transmits a secure message to a corresponding contract on the destination chain, which creates a wrapped token pegged to the value of the original.

The original coin never crosses the chain boundary. Instead, the user receives a stand-in token — Wrapped Bitcoin (WBTC), an ERC-20 token usable on Ethereum, is the classic example — while the original BTC remains locked in smart contracts.

Reversing the transfer relies on burning and unlocking: the user sends the wrapped token back to the bridge contract, which removes it from circulation. A message then travels to the source chain and the original asset is released.

Chainalysis illustrates the flow with an Ethereum-to-Solana example: an asset is locked on Ethereum, a message reaches Solana, and a wrapped copy is created there that can be used as if it were native to Solana.

From the user's perspective, the steps are short: pick the source chain and amount, send the assets to the bridge, and receive wrapped tokens on the target chain. Behind the scenes, the system depends on messages, proofs, validators, contracts and liquidity pools.

That final element matters for security. If any link in the chain fails, funds can drain quickly — as later sections show. Whether the weak link is a forged message, a flawed signature check or a missing validation step, the size of the loss tends to track how much liquidity sits behind it.

Types of Crypto Bridges

Bridges can be classified by who operates them, how they function and the direction in which they move assets. The most common distinction is between trusted and trustless designs, each with trade-offs.

A trusted, or custodial, bridge is run by a central entity, and users must trust that operator to safeguard assets. These bridges can offer a smoother experience, but the operator is in a position to misuse funds.

A trustless, or non-custodial, bridge relies on smart contracts to lock and release tokens with no central operator. Security then hinges on the quality of the code, and such bridges can be more complex and slower.

Other categories include wrapped asset bridges, which convert an asset from one chain into a compatible token on another — WBTC is the best-known example — and sidechain bridges, which link a parent chain to a child chain running a different consensus mechanism, such as the connection between Ethereum and Gnosis Chain.

Direction matters too. One-way bridges move assets only toward the destination chain with no return path, while two-way bridges operate in both directions and are better suited to general use.

Some wallets offer cross-chain swaps as another route. The wallet uses an aggregator to search decentralized exchanges for the best rate, and it may employ bridges behind the scenes without the user directly handling them.

How Much Has Been Lost to Bridge Hacks?

Bridge exploits have cost users billions. A 2026 guide put cumulative losses at more than $4.3 billion since 2021, making cross-chain infrastructure one of the most targeted areas in crypto.

An earlier Chainalysis analysis counted $1.4 billion in losses from the start of 2022. By then, the amount stolen from bridges had already surpassed $1 billion — and the total has kept climbing since.

Access control flaws were the leading cause in 2024, responsible for roughly 75% of the value lost in bridge incidents that year, or $1.7 billion. A later section examines this in more detail.

The largest single event in the source material is the $615 million Ronin exploit. Ronin was the bridge supporting the game Axie Infinity. Wormhole lost about $320 million after a weakness in its digital signature checks.

The Kelp DAO attack, reported at about $290 million, was the largest bridge-related exploit of 2026 as of May. Horizon lost about $100 million in June 2022.

Scale alone does not indicate how dangerous a flaw is. Hyperbridge lost far less only because its liquidity was limited — a bug that drains $2.5 million today could drain far more if the pool grows.

Bridge Hacks in 2026

Several bridge incidents occurred in 2026. The largest was Kelp DAO, where attackers allegedly took about $290 million. TechRadar reported that the attack targeted Kelp's LayerZero setup, and some researchers linked it to the Lazarus Group.

LayerZero reportedly said the problem stemmed from Kelp's configuration, including its use of a single DVN. Kelp disputed that characterization. The case shows that security depends on how a project sets up its messaging layer, not only on the underlying protocol.

Verus Protocol's Ethereum bridge was exploited for about $11.6 million, flagged by Blockaid and PeckShield on May 18. A fake cross-chain message tricked the bridge into sending reserves to the attacker's wallet.

The attacker drained ETH, USDC and tBTC and converted them into roughly 5,402 ETH. Blockaid said the cause was missing source-amount validation in the bridge's Solidity code, and that it was not an ECDSA bypass, a notary key compromise or a parser bug.

Hyperbridge was hit by a forged cross-chain message. The attacker gained control of a bridged DOT token contract, minted 1 billion bridged DOT and sold them into available liquidity. Initial reports put the loss at $237,000, while a later review placed realized losses near $2.5 million.

The sources disagree on timing: one guide dates the Hyperbridge loss to March 2025, while a 2026 report places it in April.

AFX Trade lost about 24.15 million USDC on July 22 after an attacker obtained the five validator signatures needed to approve a withdrawal from its bridge — matching the validator takeover pattern covered in the next section.

Why Bridges Get Hacked

A bridge must answer one difficult question: did something really happen on another chain? If the bridge answers incorrectly, money can move when it should not.

Bridges are attractive targets for three reasons: they hold large reserves, they connect multiple ecosystems, and they convert a checking error into a direct withdrawal. They also rely on complex smart contract logic spread across more than one chain.

One analysis divides attacks into two groups: code attacks, which exploit flaws in smart contracts, and network design attacks, which are often carried out through social engineering.

Most bridge hacks aim to release tokens on one chain with no matching deposit on the other. Three methods recur again and again.

Access control flaws were the leading attack vector in 2024, at roughly 75% of the value lost, or $1.7 billion, with the remainder stemming from other causes. Custodial bridges add a further risk: the operator could misuse funds.

The 2026 incidents show how these categories play out in practice: Verus and Hyperbridge fell to forged cross-chain messages, AFX Trade to an attacker who assembled the validator signatures a withdrawal required, and Kelp DAO to a dispute over how a messaging layer was configured. Validator takeover is the pattern to understand here: when a bridge releases funds only after collecting a threshold of signatures, whoever holds those signatures can authorize withdrawals with no deposit behind them.

DeFi is also far more interconnected than it was in 2022, when Nomad and Wormhole were hit. More chains, wrappers and message layers now exist, giving small validation gaps more opportunities to escalate into large losses.

How Stolen Funds Move Through Bridges

Bridges also facilitate the movement of stolen money. By linking chains, they make transaction paths harder for law enforcement and security teams to follow. Chainalysis identifies fragmented data and obscured transaction paths as the principal problems.

After the FTX collapse, hackers stole about $477 million from the exchange and began laundering it, using peel chains, CoinJoins and bridges to obscure where the funds originated and where they went. The aim was to increase anonymity.

Money laundering typically unfolds in three stages. Placement introduces dirty money into the financial system, layering moves it through many transactions to hide its source, and integration is when the funds can no longer be readily traced to crime.

Integration is a critical detection point, because crypto meets cash there. Exchanges that comply with anti-money laundering rules verify identity and the source of funds; other platforms are less stringent about these requirements.

Bridge transactions leave long trails across multiple smart contracts and steps. Chainalysis says its Reactor tool can follow funds across hundreds of bridge protocols and decentralized exchanges, with data covering more than 25 blockchains, 17 million assets and 220 million bridge transactions.

AML rules form one layer of defense. They help detect the illegal use of crypto, but they cannot stop an exploit on their own.

Other Security Incidents From July to October 2026

Bridges are not the industry's only weak point. A Santiment report covered a run of incidents from July to early October 2026, spanning exchanges, hardware wallets, bridges and software wallets. The variety is itself the takeaway: the quarter's losses came from exchange operational security, lending-protocol mechanics, a reserve mismatch, wallet firmware randomness and third-party vendor systems — different failure surfaces from the bridge exploits described above, but the same consequence for affected users.

Bitget reported a breach on September 24 with losses of about $387.5 million, up from an early estimate of $351.6 million. Mandiant and SlowMist traced it to compromised third-party security products. Bitget said its cold wallets were unaffected and its protection fund would cover users.

The Tectonic exploit followed on August 30. Cronos put affected borrowing at about $120.4 million. Validators rolled back 10,961 blocks and reversed about $111.2 million, while roughly $9.19 million had already left the network.

On September 6, a bug in the Liquid Network allowed about 4,000 LBTC to be created without backing. Blockstream said its reserve fell from about 4,205 BTC to about 197 BTC. The attacker returned 3,400 BTC, and about 600 BTC remained outstanding.

Coldcard's trouble began on July 30: a firmware error dating to March 2021 had weakened the randomness used to generate seeds. TRM Labs estimated that about 1,816 BTC, worth roughly $116 million, was drained from more than 5,200 addresses.

D'CENT's app wallet lost about 12.4 million XRP across 7,393 wallets between September 15 and 25. Trezor reported vendor breaches at ShipMonk and Brevo but said its wallets were not hacked. About 347,149 contacts were exported from Brevo, and roughly 2,500 people clicked a phishing link.

On October 9, Ledger began investigating drained wallets among customers who purchased from the reseller CryptoBilis. On-chain investigator Specter estimated losses above $86 million, but Ledger has not confirmed a total. Two days earlier, Justin Drake urged planning for AI risks to elliptic-curve cryptography, while Coinbase's Yehuda Lindell said there is no evidence the underlying assumptions have weakened.

How to Reduce Bridge Risk — and What Comes Next

No bridge is risk-free, but users can lower their exposure. Check that a bridge has passed security audits and has a long operational track record, and watch for red flags before sending funds.

The sources also list basic habits: keep funds in a secure wallet such as a hardware wallet, use strong passwords with multi-factor authentication, keep software updated, enable transaction alerts and monitor your activity for anything unusual.

Phishing is a common theft route. Check the URL before entering any private key or sensitive detail. Established platforms with long track records can offer more confidence, though none is entirely safe.

Cross-chain swaps offer another option. A wallet or service routes the swap for you, potentially avoiding direct contact with a bridge — but they have limits too, such as fewer supported tokens and fees.

Bridges suit advanced needs, such as moving tokens that swap services do not support, while swaps suit basic trades between popular tokens.

Newer protocols aim to cut risk. Chainlink's CCIP has processed over $28.6 trillion in transfers without a protocol-level exploit, using decentralized validation. Wormhole added zero-knowledge proof verification and cross-chain governance in 2024. 1inch, which offers cross-chain swaps, says its product executes a user's instructions without taking custody of assets — a claim that comes from the company itself.

These developments point toward stronger validation standards, but exploits remain a risk. Access control flaws, single points of failure and weak configurations have driven many losses so far, and users should weigh each option carefully before moving assets. The signals worth watching are the ones behind this year's losses: how many independent parties must verify a cross-chain message, whether a configuration concentrates trust in a single verifier — the point LayerZero and Kelp disputed — how much liquidity sits behind one contract, and whether an operator can move user funds unilaterally.

Sources

• What Is a Blockchain Bridge? (updated Apr 21, 2026)
• What is a Crypto Bridge? (published Jul 15, 2024, updated Jul 17, 2026)
• Introduction to Cross-Chain Bridges (Chainalysis Team, Dec 5, 2024)
• Justin Drake's "Bunker Mode" Warning Meets Ledger and Bitget Security Fears (Trader Edge, Oct 13, 2026)
• What is bridging in crypto?
• The biggest bridge hacks in 2026 (Vladimir Kozlov, May 21, 2026)
• How Do Hackers Use Crypto Bridges to Steal?

Source: CoinCentral