Why Bridges Became Crypto’s Favorite Target

A cross-chain bridge exists to solve a real problem: blockchains generally can’t talk to each other directly, so moving value from one to another requires locking assets on the first chain and minting a matching representation on the second. That design necessarily concentrates enormous value into a single smart contract or a small set of trusted validators, exactly the kind of target attackers look for. In 2022 alone, according to blockchain analytics firm Chainalysis, cross-chain bridge hacks accounted for 69% of all cryptocurrency stolen that year, roughly $2 billion across 13 separate incidents, including two of the three largest crypto thefts in history.

Understanding why bridges specifically became this attractive, rather than treating each hack as an isolated incident, is the difference between recognizing a structural pattern and just reading another headline about stolen millions.

Key Facts

TL;DR

• Bridges concentrate huge amounts of locked value into a single point, a smart contract or a small validator set, which Chainalysis has directly described as “a more desirable honeypot could scarcely be imagined.”
• In 2022, bridge hacks accounted for 69% of all crypto stolen that year, a disproportionate share relative to how much total value actually flows through bridges compared to other crypto infrastructure.
• The two largest bridge hacks of that year show two entirely different failure modes: Ronin’s $625 million loss came from compromised validator keys, while Wormhole’s $325 million loss came from a flaw in the contract code itself.
• North Korea’s Lazarus Group has been directly tied to the Ronin hack and is estimated to have stolen roughly $1 billion from bridges and other DeFi protocols in 2022 alone, showing bridges have become a target for state-sponsored theft, not just independent hackers.
• Bridges remain relatively new, complex software, and Chainalysis has noted that “if a bridge gets big enough, any error in its underlying smart contract code or other potential weak spot is almost sure to eventually be found and exploited.”

Why Bridges Are Structurally Different From Other DeFi Targets

Most DeFi hacks target a single protocol’s own logic. A bridge is a different kind of target because of what it has to do by design: hold a large pool of real assets on one chain while representing an equivalent claim on another chain, and keep those two sides perfectly synchronized. Chainalysis has explained this directly, noting that bridges “feature a central storage point of funds that back the ‘bridged’ assets on the receiving blockchain,” and that regardless of whether those funds sit in a smart contract or with a centralized custodian, “that storage point becomes a target.”

This matters because it means a bridge’s attack surface isn’t just its own code. It includes whatever mechanism verifies that a deposit on one chain actually happened before minting an equivalent asset on the other, a verification step that has to work correctly across two entirely different blockchain architectures, each with its own quirks, at every single transaction.

Ronin: When the Weak Point Was People, Not Code

The Ronin Bridge, built to support the play-to-earn game Axie Infinity, used a validator system requiring 5 of its 9 validator signatures to approve any withdrawal. On March 23, 2022, attackers obtained enough private keys to meet that threshold and withdrew 173,600 ETH and 25.5 million USDC, worth roughly $625 million at the time, the largest crypto theft in history at that point. The breach went unnoticed for six days, until a user reported being unable to withdraw funds.

According to Ronin’s own post-mortem and subsequent FBI attribution, the attack succeeded through social engineering rather than a code vulnerability: a Sky Mavis employee was reportedly targeted with a fake job offer, ultimately allowing attackers to compromise enough validator infrastructure to forge legitimate-looking approval signatures. The U.S. Treasury Department later sanctioned the attacker’s wallet address and formally attributed the theft to North Korea’s Lazarus Group, tying a bridge hack directly to a state-sponsored theft operation. Roughly $30 million was later recovered by the FBI, and Norwegian authorities separately seized another $5.8 million, but the large majority of the stolen funds were never recovered.

Ronin’s case demonstrates a specific bridge vulnerability: a “decentralized” system that actually depends on a small number of trusted validators reduces, in practice, to trusting whoever controls those validators’ keys, a much smaller and more human attack surface than the blockchain’s underlying cryptography itself.

Wormhole: When the Weak Point Was a Single Deprecated Function

Wormhole, a bridge connecting Ethereum and Solana, suffered a $325 million loss less than two months before Ronin, on February 2, 2022. Here, the failure was purely technical. According to CertiK’s incident analysis, an attacker exploited a flaw in how Wormhole’s Solana-side contract verified signatures, using a deprecated function that failed to properly check certain account addresses. This let the attacker submit a forged verification message claiming a deposit of 120,000 ETH had occurred on the Ethereum side, when no such deposit had actually happened, and the bridge minted the equivalent wrapped tokens on Solana anyway.

Jump Trading, Wormhole’s backer, replaced the stolen funds within hours to keep the bridge solvent for its users, an unusually fast and well-resourced recovery that most protocols experiencing a hack of this scale would not be able to match. The underlying lesson is distinct from Ronin’s: this wasn’t a case of compromised trust in specific people, but a case of a single overlooked function, in code that had presumably been reviewed, creating an opening wide enough for a quarter-billion-dollar theft.

Comparison: Two Different Ways Bridges Fail

Who Benefits, and Who Absorbs the Risk

Bridges exist because users and developers genuinely want to move value across chains, and the demand that creates real liquidity is exactly what makes a successful attack so lucrative. Attackers, including state-sponsored groups like Lazarus, benefit directly and, as Chainalysis has documented, launder proceeds through increasingly sophisticated cross-chain techniques specifically designed to frustrate tracing. Bridge operators face reputational damage and sometimes step in to cover losses, as Wormhole’s backer did, but that kind of rescue depends on having a well-capitalized backer willing to absorb a nine-figure loss, which most protocols don’t have. Ordinary users holding assets on the bridged side of these systems bear the actual risk of loss if no such rescue happens.

Practical Guidance

• Understand that using a cross-chain bridge means trusting both the bridge’s code and, in many designs, a specific set of validators or custodians, not just the blockchains on either side.
• Check whether a bridge’s design relies on a small validator set (as Ronin did) or a fully algorithmic verification process (as Wormhole did), since each carries a different kind of risk.
• Avoid leaving significant funds on the “wrapped” or bridged side of an asset for longer than necessary; the exposure exists for as long as the funds sit there, not just during the transfer itself.
• Watch for whether a bridge discloses its security audit history and whether it has a demonstrated track record of quickly detecting and responding to anomalies, since Ronin’s breach went unnoticed for six days.
• Recognize that a bridge’s total value locked is itself a risk indicator. The larger the pool concentrated in a single bridge, the larger the incentive for a sophisticated or state-sponsored attacker to target it.

What Happens Next

Expect continued attacker interest in bridges for the same reason Chainalysis identified: as long as bridges concentrate large amounts of value into a single point, whether a smart contract or a validator set, they remain, in the firm’s own words, “a more desirable honeypot could scarcely be imagined.” Some newer bridge designs have moved toward more decentralized or algorithmically verified models specifically to reduce the kind of validator concentration that enabled the Ronin hack, and increased scrutiny from firms like Chainalysis and CertiK has pushed more bridges toward rigorous, ongoing audits rather than one-time reviews. Still, as long as different blockchains remain unable to communicate natively, bridges will remain a necessary piece of infrastructure, and necessary infrastructure holding concentrated value will keep attracting attackers with the resources to look for its weakest link.

FAQs

Why are cross-chain bridges hacked more often than other DeFi protocols?

Bridges concentrate large amounts of locked value into a single smart contract or validator set in order to function, which Chainalysis has described as creating an unusually attractive target relative to their complexity and relatively young codebases.

What’s the difference between how Ronin and Wormhole were hacked?

Ronin was compromised through stolen validator private keys obtained via social engineering, a human and trust-based failure. Wormhole was compromised through a flaw in its verification code itself, a purely technical failure.

Was the Ronin Bridge hack linked to a specific country?

Yes. The FBI formally attributed the attack to North Korea’s Lazarus Group, and the U.S. Treasury Department sanctioned the wallet address holding the stolen funds.

Did bridge hack victims ever get their funds back?

Outcomes varied significantly. Wormhole’s backer, Jump Trading, replaced the stolen funds within hours. Ronin recovered only a small fraction of its losses through law enforcement action, with most of the stolen funds never returned.

Sources

• Chainalysis, “Cross-Chain Bridge Hacks Emerge as Top Security Risk”
• Chainalysis, “Crypto Community Makes Profiting Hard for North Korean Hackers”
• Chainalysis, “2022 Biggest Year Ever for Crypto Hacking”
• CertiK, “Wormhole Bridge Exploit Incident Analysis”

This article is for educational purposes and does not constitute financial or legal advice. Cross-chain bridges and other DeFi infrastructure carry risk of partial or total loss of funds. If you are making decisions about using bridging protocols, consider consulting a licensed financial advisor.