Crypto bridge hacks: why bridges get drained

Bridges get drained because they hold a large pool of locked assets that is released whenever the bridge believes a message from another chain. Whoever can forge that message, or control the parties that sign it, can take the pool, and the verified cases in our hack database show each of these routes.

How a bridge works

A blockchain cannot read another blockchain directly. A bridge connects two of them with three parts:

1. A vault on the source chain that locks the asset a user sends in.
2. A verifier that confirms the lock happened: a set of validators, a group of signers, a light client or a messaging protocol.
3. A token on the destination chain that is minted (or released from a second vault) once the verifier says yes.

Going back, the destination token is burned and the verifier tells the source vault to release the original. The design is often called lock and mint. Tether's bridged USDT0, for example, locks the original USDT in a contract on Ethereum and mints the equivalent token on the target chain, according to its documentation.¹

The weak point follows from the design. The tokens on the destination chain are only worth something because the vault holds the backing. If an attacker can make the verifier approve a release that never had a deposit behind it, the vault pays out real assets, or the destination chain ends up with tokens nobody can redeem.

Route 1: a forged or misread message

The verifier checks a message. If the check has a gap, a fake message passes.

• Kelp DAO. A forged cross-chain message was accepted by the Kelp DAO rsETH bridge built on LayerZero, unlocking 116,500 rsETH for an attacker, according to the LayerZero Labs incident report.² (incident page)
• Wormhole. An attacker abused a flaw in the bridge's core contract on Solana to mint unbacked wETH and bridged it back to Ethereum. The Wormhole Foundation later cited the case in the design of its Governor safeguard.³ (incident page)
• Syscoin. An interpretation mismatch between Syscoin Core and the NEVM relay in its bridge caused an unauthorized release of 5 billion SYS. The attacker returned the funds to a Syscoin recovery address, where they were burned.⁴ (incident page)

In each case the vault behaved as designed. It trusted a message it should not have trusted.

Route 2: the validators or signers

Many bridges are secured by a set of validators or signers, and a release needs a majority of them. That turns the bridge's security into the security of those keys.

• Shibarium. An attacker who had compromised most Shibarium validators drained bridge assets worth more than $4 million, according to K9 Finance DAO.⁵ (incident page)
• IoTeX ioTube. An attacker compromised the owner account of the ioTube bridge validator contract on Ethereum, minted 410M CIOTX and drained approximately $4.4M from the bridge reserves, according to IoTeX.⁶ (incident page)
• Harmony's Horizon bridge. The FBI attributed the theft of $100 million from the bridge to North Korea's Lazarus Group.⁷ (incident page)
• Ronin. The US Treasury said North Korea's Lazarus Group stole virtual currency worth almost $620 million from a blockchain project linked to the online game Axie Infinity.⁸ Our database files it under the type hack, as its sources describe it (incident page).

A threshold of signers is only as strong as the number of independent keys behind it. If several signers run on the same infrastructure, or one party holds several keys, the effective threshold is lower than it looks.

Route 3: central control

Some bridges are run by one team that holds the keys to the vault. Then the risk is not a bug but the operator.

On Multichain, assets worth over US$127 million were moved out of the cross-chain bridge, and the Fantom Foundation put total losses across chains at over $210 million. A Singapore High Court judgment records Fantom's claim that the Multichain CEO controlled the bridge assets.⁹ (incident page) We state what the judgment records; it is the court's record of the claim, not our finding.

Bridges as the exit

Bridges also appear in incidents that started somewhere else. An attacker who creates value on one network often needs a bridge to move it to a chain with deeper markets.

• On Flow, an attacker counterfeited tokens through a network vulnerability and bridged approximately $3.9 million off the network before validators halted the chain.¹⁰ (incident page)
• On the Liquid sidechain, an attacker used a consensus bug to create unbacked L-BTC and pegged out approximately 4,000 BTC. The attacker returned 3,400 BTC the next day.¹¹ (incident page)

Stopping the exit is often what limits the damage. In the Flow case the validators halted the chain; on GalaChain, where an attacker made unauthorized transfers and bridged the proceeds out, Gala paused the bridge and deployed a fix the same morning (incident page).

What the cases have in common

• The vault is the prize. Every case ends at a pool of locked assets or at a minting right.
• The attack is on trust, not on the chains. Neither the source chain nor the destination chain was broken. The verifier or the keys in between were.
• Recovery varies widely. Syscoin's funds were returned and burned, IoTeX said most of the minted tokens were locked or frozen, Verus recovered part of its loss and set out a plan to restore full backing.¹² Others record no recovery at all.
• Amounts are often stated in tokens. Several sources state the loss in the bridged asset (rsETH, SYS, CIOTX) instead of dollars. We keep the source's own figure.

Following bridge incidents on our pages

Filter the hack database by type to see every bridge exploit with its chain, amount as stated, status and primary sources. Our security monitoring also watches net outflows from a set of bridge and lending contracts whose addresses come from the protocols' own documentation; the thresholds are listed in How we report incidents. A large withdrawal and an exploit look the same on-chain, so these alerts say "outflow", never "hack". Live items appear in Security › Latest, and addresses that official sources name as attacker wallets are on Listed wallets.