What is a crypto bridge? How bridges work and why they get hacked

A crypto bridge is a service that lets you move tokens or data from one blockchain to another — for example, from Ethereum to Solana or BNB Chain. Blockchains are separate systems that cannot read each other's records, so a bridge acts as the go-between: it confirms that something happened on one chain and then triggers a matching action on the other.

Bridges are essential plumbing for a multi-chain crypto world, but they are also one of its weakest points. This explainer covers how they work, the main types, why they are hacked so often, and how to use them more carefully. It is educational, not investment advice.

Why bridges exist

Each blockchain has its own tokens, apps and fees. Ethereum has the deepest DeFi markets; layer-2 networks such as Arbitrum or Base are cheaper; Solana is fast; many tokens launch on several chains at once. If you hold USDC on Ethereum but want to use an app on another network, you need a way to get value there. You can sell on one chain and buy on another through an exchange, or use a bridge to move the asset directly from your wallet.

Bridges also carry messages, not just tokens: a governance vote, an instruction to mint, or a cross-chain swap all travel as messages that the bridge verifies and relays.

How a bridge moves a token

Because a coin can't literally travel between chains, bridges use a few standard tricks:

1. Lock and mint. You send tokens to a bridge contract on chain A, where they are locked. The bridge then mints the same amount of a wrapped version on chain B. To go back, the wrapped tokens are burned and the originals unlocked.
2. Burn and mint. For tokens issued natively on several chains, the bridge burns them on the source chain and mints fresh ones on the destination. Circle's cross-chain transfer protocol for USDC works this way, so no pool of locked coins is left behind.
3. Liquidity networks. The bridge keeps pools of the same token on both chains. You deposit on one side and receive from the pool on the other, minus a fee. Nothing new is minted, but the pools must be well funded.

The key point: in the first model, the wrapped token on chain B is effectively an IOU backed by the coins locked on chain A. If someone drains the locked coins, or tricks the bridge into minting tokens with nothing locked behind them, the wrapped tokens can lose their value.

Types of bridges by trust model

The biggest difference between bridges is who or what verifies that a deposit really happened.

Layer-2 networks usually have an official canonical bridge run by the rollup itself. Withdrawals from optimistic rollups back to Ethereum can take about a week because of a challenge period; faster third-party bridges exist, but they add their own trust assumptions.

Why bridges get hacked so often

Bridges hold large pools of locked assets and have the power to create tokens, which makes them high-value targets. Some of the largest crypto hacks ever were bridge exploits — including Ronin (about $625 million in 2022), Wormhole (about $320 million in 2022) and Nomad (about $190 million in 2022). Common failure points:

• Stolen signer keys. If an attacker controls enough of the keys that approve withdrawals, they can drain the bridge.
• Verification bugs. A flaw in the code that checks messages can let an attacker "prove" a deposit that never happened.
• Off-chain infrastructure. Databases, servers and relayers that feed the bridge can be the weak link. In October 2026, Cysic halted its bridge after an attacker used unauthorised database access to mint 10 million unbacked tokens.
• Fake bridge websites. Phishing sites copy real bridge interfaces and ask you to approve a malicious transaction — see our guide on how to spot crypto scams.

How to use a bridge more safely

• Prefer canonical or issuer bridges — the rollup's official bridge, or the stablecoin issuer's own transfer service — over little-known third-party options.
• Use the official URL from the project's documentation, and bookmark it. Don't click bridge links from ads or direct messages.
• Send a small test amount first and confirm it arrives before moving the rest.
• Check which token you receive. The same symbol can exist as several wrapped versions on one chain; make sure apps accept the version you get.
• Review approvals you grant to bridge contracts and revoke ones you no longer need.
• Keep fees and timing in mind: you pay gas on both chains, and some routes take minutes, others days.
• Consider an exchange instead. Depositing on one network and withdrawing on another through a reputable exchange swaps bridge risk for exchange (custody) risk — compare the trade-offs in our CEX vs DEX guide.

Bridges and DeFi

Bridged tokens are everywhere in decentralized finance: they sit in liquidity pools, serve as loan collateral and back other tokens. That means a single bridge failure can ripple outward, hitting traders and protocols that never used the bridge directly. When you evaluate a DeFi position, it is worth asking whether the token is native to that chain or a bridged IOU — and who stands behind it.