In this lesson
- find out how a bridge moves tokens between networks
- understand why bridges are among the most frequent targets of big thefts
- learn to use a bridge with as little risk as possible
You cannot send money between networks directly – every blockchain is an island. A bridge between them looks solid at first sight. Underneath, though, there are often a few people with keys, or one program nobody checked properly. And a pile of money waits at the other end.
How a bridge works#
A typical bridge does not actually move tokens:
- On network A you lock 1 ETH in the bridge's contract.
- The bridge checks it and creates 1 "wrapped" ETH for you on network B.
- When you want to go back, the wrapped ETH is burned on network B and the original is released on network A.
A wrapped token is worth something only as long as the original ETH really is locked in the bridge. If someone steals it, the wrapped tokens are suddenly backed by nothing.
Who guards the bridge#
- A rollup's official bridge relies on the rollup's rules and on Ethereum. It is the safest, but from optimistic rollups it is slow (7 days).
- A bridge with validators relies on a group of people or servers who confirm transfers. If an attacker controls enough of them, they can "confirm" anything.
Big bridge hacks#
| Bridge | When | Stolen | What happened |
|---|---|---|---|
| Ronin | March 2022 | ~625M USD | the attackers got 5 of 9 validator keys |
| Wormhole | Feb 2022 | ~325M USD | a bug in signature checking |
| Kelp DAO (rsETH) | April 2026 | ~292M USD | a single validator confirmed transfers, and the attackers fooled it |
| Nomad | Aug 2022 | ~190M USD | a bug in an upgrade; hundreds of people then copied the attack |
| Harmony Horizon | June 2022 | ~100M USD | 2 keys out of 5 were enough |
According to investigators, the North Korean group Lazarus is behind the Ronin, Harmony and Kelp DAO attacks.
Using a bridge with less risk#
- Between Ethereum and its rollup use the rollup's official bridge if you are not in a hurry.
- For small amounts fast bridges are convenient – but do not keep big money in wrapped tokens for long.
- Find the bridge through official pages of the rollup or the wallet, not through a search engine ad.
- Prefer native tokens: USDC issued directly on a network is safer than "USDC.e" carried over by a bridge.
A bridge is a bet on its security
Every transfer through a bridge adds the risk that the bridge gets hacked. Bridges are among the most frequent targets of large thefts in crypto because they hold big money guarded by a few keys or a single program.
Common myths#
- "A bridge moves my ETH to another network." It moves a promise. Your ETH stays locked in the bridge.
- "A big bridge is safe." Ronin was big. Big money attracts the best attackers.
- "A wrapped token always has the same price as the original." Only as long as the bridge holds the originals.
Summary
- A bridge locks tokens on one network and issues a wrapped copy on another.
- The copy's value rests on the bridge's security.
- Big hacks: Ronin 625M, Wormhole 325M, Kelp DAO 292M USD.
- For larger amounts use the rollup's official bridge and native tokens; find bridges only through official pages.