.jpg)
A blockchain bridge is the piece of plumbing that lets you move a token from one chain to another — say, USDC from Ethereum to Arbitrum, or ETH into a Layer 2. It sounds mundane. It is also the single most dangerous place your crypto can sit. Bridges have accounted for roughly 40% of all value stolen in Web3, about $2.8 billion, and the four biggest bridge failures alone erased more than $1.7 billion.
This guide is crypto bridges explained without the jargon: what a bridge actually does, the three mechanical designs you will meet, why they get drained so often, and a five-step routine for crossing chains without becoming a headline. If you want to go deeper on the mechanics behind the trades you place, our structured crypto trading course covers the risk discipline this article only introduces.
- A bridge doesn’t “send” a coin across chains — it locks or burns it on one side and issues a matching token on the other.
- Three designs dominate: lock-and-mint, burn-and-mint, and liquidity-pool. They fail in different ways.
- Bridges are crypto’s richest hacking target: one exploit can drain nine figures in a single transaction.
- Most retail losses are avoidable — use canonical bridges, verify the URL, and test with a small amount first.
What is a blockchain bridge?
A blockchain bridge is a protocol that moves value or data between two blockchains that cannot natively read each other. Because Ethereum and, say, Solana run separate consensus systems, neither can see the other’s balances. A bridge stands in the middle: it proves that something happened on the source chain, then authorises a matching action on the destination chain.
Here is the mental model that keeps you safe: nothing actually crosses the bridge. Your original coins never leave their home chain. The bridge either locks them or destroys them, and a representative token appears on the other side. Understanding that one sentence is the difference between using bridges carefully and trusting them blindly.
Picture moving 1 ETH from Ethereum to a Layer 2. On a lock-and-mint bridge, your 1 ETH is locked in a contract on Ethereum and 1 bridged-ETH is minted for you on the Layer 2. You now hold a claim, not the original coin. Send it back, and the bridged-ETH is burned while your real ETH unlocks. The bridge is really a locked vault plus an accounting entry — not a tunnel. Every design in the next section is just a different way of running that vault and that ledger.
You need a bridge whenever an asset lives on one chain but the app, cheaper fees, or yield you want lives on another. That is why bridges became core infrastructure the moment Layer 1 and Layer 2 networks multiplied — and why so much value now flows through them.
How do crypto bridges work?
Every bridge answers the same question — “how do I prove an action on chain A to chain B?” — but they answer it with three different mechanics. Knowing which one you are using tells you where the risk sits.
Lock-and-mint is the classic design. The bridge locks your native asset in a smart contract on the source chain and mints a wrapped IOU on the destination chain. Bridge back, and the wrapped token is burned while the original is unlocked. It needs no pre-funded liquidity on the far side, but it concentrates everyone’s deposits into one giant locked pool — a honeypot.
Burn-and-mint destroys the token on the source chain and mints an equal amount on the destination chain, keeping total supply constant. Because nothing sits in a growing locked vault, there is no single honeypot to drain — which is why natively multi-chain tokens increasingly use it.
Liquidity-pool bridges never mint anything. They keep inventory of the same asset on both chains and simply pay you out of the destination pool while topping up the source pool. No massive locked contract — but if everyone bridges one direction at once, the pool runs dry and you eat slippage.
| Factor | Lock-and-mint | Burn-and-mint | Liquidity-pool |
|---|---|---|---|
| What happens to your coin | Locked on source chain | Burned on source chain | Swapped via pools |
| What you receive | A wrapped IOU token | A freshly minted native token | The real asset from inventory |
| Needs pre-funded liquidity? | No | No | Yes — on both sides |
| Main risk | Locked-pool honeypot | Mint-authority compromise | Imbalance & slippage |
Source: Eco bridge glossary, 2026; Chainscore Labs bridge-design notes, 2026.
What this means for you: a wrapped token is only as trustworthy as the bridge that minted it. If that bridge is exploited, your wrapped balance can become worthless even though the “real” coins are frozen on the other chain. This is also why bridges sit at the heart of how DeFi actually works across multiple chains.
Why are bridges the biggest hack target in crypto?
Because that locked pool is where the money is. A bridge holding hundreds of millions in a single contract offers attackers the best payoff-per-effort in the entire industry — steal the keys or trick the verification logic once, and you drain everything in one transaction.
The numbers are brutal. Chainalysis has tracked more than $2.5 billion in bridge losses across 2021–2023, and 2022 alone saw over $2 billion stolen from token bridges. Here are the four failures that define the category.
Why does the industry keep bleeding at this exact spot? Because a bridge has to be trusted by two chains at once, and every extra validator, relayer or admin key it adds to make that work is another door. Audits catch known bugs; they cannot catch a leaked private key or a team member fooled by a fake job offer. The attack surface grows with the bridge’s ambition — the more chains and features it supports, the more ways it can fail.
The four largest crypto bridge hacks (USD, at time of exploit)
Source: Chainalysis and public incident disclosures, 2021–2022. Figures are approximate values at the time of each exploit.
Look at the failure modes and a pattern appears. Ronin (~$625m, March 2022) fell because attackers captured five of nine validator keys — a people-and-permissions failure, not a math one. Poly Network (~$611m, August 2021) was a cross-contract logic flaw; most funds were later returned. Wormhole (~$325m, February 2022) was a signature-verification bug. Nomad (~$190m, August 2022) was a botched configuration that let people copy-paste a successful exploit and drain the pool in a crowd.
The lesson: bridges rarely break because cryptography is weak. They break at the seams — validator sets, admin keys, upgrade logic, configuration. That is exactly the kind of risk you cannot see from a slick front-end, and exactly why the bridge you choose matters more than the bridge’s marketing.
Are crypto bridges safe?
Yes — with discipline. The multi-billion-dollar losses came overwhelmingly from a handful of poorly secured bridges, many of which no longer exist or have since rebuilt with stronger trust models. The gap between the safest and the weakest bridge is enormous, and choosing well removes most of your risk before you ever click “confirm.”
Think in tiers. A network’s canonical bridge — the official one run by the chain itself, common for moving onto a Layer 2 — adds the fewest extra trust assumptions. Third-party and cross-chain bridges add convenience but also add the validator sets and admin keys that history shows are the weak points.
Before you trust a bridge with real size, check three things: whether it has been independently audited, how long it has run without an incident, and how it is governed. A bridge controlled by a single upgradeable admin key is riskier than one secured by a broad, decentralised validator set, because that one key is a single point of failure. None of these checks guarantees safety — but together they separate the launch-grade from the battle-tested, and they take five minutes you will never regret spending.
Wrapped tokens vs native tokens
When you bridge, check whether you will land holding a native asset or a wrapped one. A wrapped token is a claim backed by the bridge’s locked collateral; if that bridge is compromised, the peg can break. A native asset carries no such dependency. Neither is automatically wrong — but you should always know which one you are holding, and where you will ultimately store it. For anything you are not actively moving, a cold wallet beats a hot wallet.
Bridge risk is also live, not historical. Through the first half of 2026, cross-chain bridges still lost roughly $340 million across 14 exploits (as of early June 2026), with a single incident accounting for close to $293 million. The design has matured; the target has not moved.
How to bridge crypto safely: a 5-step checklist
You cannot audit a smart contract yourself, but you can remove the mistakes that drain most retail users. Run this sequence every time.
Source: Merkle Science and Eco bridge-safety guidance, 2026.
Do this and the maths flips in your favour: the catastrophic losses come from protocol-level failures you cannot control, but the everyday losses come from phishing and haste — which you can.
Mistakes that get bridge users drained
- Chasing an unknown bridge for a few dollars of savings. The cheapest route is worthless if the contract is unaudited.
- Approving unlimited spending. A blanket token approval is a standing invitation; grant only what the transfer needs, then revoke.
- Ignoring liquidity. On pool bridges, a thin destination pool means real slippage — check depth before large moves.
- Assuming wrapped equals native. If the bridge behind your wrapped token breaks, your “dollar” may no longer be worth a dollar.
- Bridging your whole stack at once. One transaction, one point of failure. Break it up.
Frequently asked questions
Trading and holding crypto involve substantial risk of loss and are not suitable for every investor; digital-asset volatility and regulatory treatment vary by country. This article is educational content, not investment advice.
.jpg)
.jpg)
