Why Bridges Became Crypto’s Favorite Target

A cross-chain bridge exists to let assets move between separate blockchains that otherwise can’t talk to each other, and to do that, it has to lock up a large pool of real assets on one side while minting an equivalent representation on the other. That locked pool is, structurally, one of the most concentrated stores of value in all of crypto, guarded not by an entire blockchain’s worth of miners or validators, but often by a small, specific set of keys or signers. Blockchain analytics firm Chainalysis put it plainly in its own research: bridges create “a more desirable honeypot” than almost anything else in the industry, and in 2022 alone, that honeypot accounted for 69% of all cryptocurrency stolen across the entire sector, roughly $2 billion.

This article explains exactly why bridges ended up this exposed, using two of the largest bridge hacks in history as evidence, and what that structural weakness means for anyone moving assets across chains today.

Key Facts

TL;DR

• A bridge concentrates value by design: it must hold real locked assets on one chain to back the equivalent tokens it mints on another, making it a single, high-value target rather than a distributed one.
• Bridges accounted for 69% of all crypto stolen in 2022, about $2 billion across 13 separate hacks, far more than any other category of crypto infrastructure that year.
• The Ronin Bridge’s $625 million theft didn’t come from a code bug at all. It came from social engineering, a fake job offer that gave attackers control of enough validator keys to approve fraudulent withdrawals.
• A previous Crypto Encounter piece, “Why DeFi Hacks Keep Happening After Audits,” covered how the Nomad Bridge’s $190 million exploit came from a deployment configuration error rather than a code flaw an audit would catch, a different failure mode than Ronin’s, but the same underlying lesson: bridges fail in more ways than ordinary smart contracts do.
• Bridges typically rely on a smaller, more centralized set of trusted signers than the base blockchains they connect, which means their real security model is often weaker than either chain on its own, regardless of how decentralized the overall system appears.

Why Bridges Concentrate Risk by Design

Moving an asset from one blockchain to another isn’t as simple as transferring it directly, since most blockchains can’t natively read or verify what happened on a different chain. Bridges solve this by locking the original asset in a smart contract on the source chain and minting a corresponding token on the destination chain. That locked pool of assets has to sit somewhere, backing every “bridged” token in circulation, and it has to be large enough to support significant trading volume to be useful at all.

Chainalysis’s own research described the resulting dynamic directly: bridges “feature a central storage point of funds that back the ‘bridged’ assets on the receiving blockchain,” and regardless of whether that storage point is a smart contract or a set of validator keys, it becomes an obvious target the moment enough value flows through it. Unlike a base-layer blockchain, where attacking consensus directly would require controlling a majority of a large, distributed network, a bridge’s security often comes down to a much smaller number of trusted parties, whether that’s a multisignature wallet, a validator set, or in some designs, a single centralized operator.

Ronin Bridge: When the Weak Point Was People, Not Code

The Ronin Bridge, built to support the blockchain game Axie Infinity, protected its funds using a validator system requiring 5 of 9 validator signatures to approve any withdrawal. On paper, that threshold looks like a reasonable decentralized safeguard. In practice, Sky Mavis, the company behind Axie Infinity, controlled four of those nine validators directly, and had also been granted temporary signing authority over a fifth validator belonging to the Axie DAO months earlier, an arrangement that had never been revoked even after it was no longer needed.

According to reporting by The Block, attackers later identified by the U.S. government as North Korea’s Lazarus Group approached a senior Sky Mavis engineer with a fake job offer through LinkedIn. The recruitment process culminated in a PDF document that, once opened, installed malware giving the attackers a foothold inside Sky Mavis’s internal systems. From there, they were able to compromise enough of the company’s validator infrastructure to reach the five signatures needed, and on March 23, 2022, they forged two fraudulent withdrawal transactions, draining 173,600 ETH and 25.5 million USDC, worth roughly $625 million at the time. The theft went unnoticed for six days, until a user reported being unable to withdraw funds from the bridge.

This case matters specifically because no smart contract vulnerability was involved at all. The code did exactly what it was designed to do: release funds once five valid validator signatures approved a withdrawal. The actual weak point was the same one that undermines security in almost every industry: a person, targeted individually, who unknowingly gave attackers a way in.

A Wider Pattern, Not an Isolated Case

Ronin is the largest single bridge theft, but it’s one entry in a much longer list. Poly Network lost roughly $611 million in August 2021 to a cross-chain contract logic flaw, in what was, at the time, the largest DeFi hack ever recorded, though the attacker ultimately returned nearly all of the funds. Wormhole lost roughly $325 million in February 2022 after an attacker found a way to forge a valid-looking signature. Nomad Bridge, covered in detail in a previous Crypto Encounter piece, lost $190 million in August 2022 after a deployment configuration error let anyone bypass verification entirely, a flaw the auditing firm CertiK itself said was difficult to catch through conventional code review.

Each of these hacks used a different specific technique. What they share is the underlying target: a concentrated pool of locked value, protected by a security model narrower than the base blockchains on either side of the bridge.

Comparison: Base Blockchain Security vs. Bridge Security

What Users Actually Lose, and Who Benefits

When a bridge is exploited, the loss typically falls on everyone holding the “bridged” representation of an asset on the destination chain, since that token’s value depends entirely on the locked reserve backing it. Attackers, in cases like Ronin, gain enormous sums with minimal ongoing operational cost once they’ve achieved the initial compromise, and nation-state actors like North Korea’s Lazarus Group have used exactly this kind of theft to fund other operations, according to U.S. Treasury findings. Bridge operators face reputational damage and, in some cases like Sky Mavis’s, significant costs to reimburse users, but recovery for individual holders during the gap before any reimbursement is never guaranteed.

Practical Guidance

• Before using any cross-chain bridge, check how its validator or signer set is structured, including how many independent parties are required to approve a withdrawal and whether that threshold has ever been temporarily changed, as happened with Ronin’s Axie DAO permission.
• Prefer bridges that have undergone independent security review of both their code and their operational key-management practices, not just their smart contracts.
• Avoid leaving large balances in bridged form longer than necessary; moving assets back to their native chain when you’re not actively using them reduces exposure to a bridge-specific failure.
• Recognize that a bridge’s decentralization claims may not reflect its actual practical security, since a small number of validators can create a real single point of failure even if the underlying blockchains themselves are highly decentralized.
• Follow post-mortems from major bridge exploits, since the specific technique changes each time, but the underlying lesson, concentrated value plus a narrow trust model, remains applicable across nearly every case.

What Happens Next

Expect bridge security to keep improving through wider validator sets, multi-party computation designs that eliminate single points of key compromise, and more rigorous review of deployment processes following cases like Nomad’s. None of these fixes changes the fundamental economics Chainalysis identified: as long as bridges concentrate large amounts of value behind a narrower security model than the blockchains they connect, they will remain a disproportionately attractive target, for skilled code-level attackers and for patient, well-resourced social engineering campaigns like the one that brought down Ronin.

FAQs

Why are cross-chain bridges hacked so much more often than base blockchains like Bitcoin or Ethereum? Bridges concentrate large amounts of locked value behind a much smaller security model, often a limited set of validator keys or a multisignature wallet, rather than the thousands of independent participants securing a major blockchain’s consensus.

Did the Ronin Bridge hack involve a bug in the smart contract code? No. Attackers gained control of enough validator private keys through a social engineering attack, a fake job offer that delivered malware, to forge valid-looking withdrawal approvals. The contract logic itself functioned as designed.

How much crypto has been stolen from bridges overall? Chainalysis estimated roughly $2 billion was stolen from cross-chain bridges in 2022 alone, accounting for 69% of all cryptocurrency stolen that year across the entire industry.

Is it possible to make a cross-chain bridge as secure as the blockchains it connects? It’s difficult in practice, since a bridge inherently requires some trusted mechanism to relay information between otherwise incompatible chains. Newer designs aim to reduce this trust requirement, but most bridges in use today still rely on a narrower security model than either connected blockchain.

Sources

• Chainalysis, “Cross-chain Bridge Hacks Emerge as Top Security Risk”
• Elliptic, “$540 million stolen from the Ronin DeFi bridge”
• The Block, “How a fake job offer took down the world’s most popular crypto game”
• CoinDesk, “US Officials Tie North Korea’s ‘Lazarus’ Hackers to $625M Ronin Bridge Theft”

This article is for educational purposes and does not constitute financial or legal advice. Cross-chain bridges carry risk of partial or total loss of funds independent of the security of the underlying blockchains they connect. If you are making decisions about moving significant assets across chains, consider consulting a licensed financial advisor.