Crypto Bridge Hacks: Why They Happen So Often

Article Summary

• 🌉 A crypto bridge is the process of moving assets between blockchains through a lock-and-mint mechanism.
• 🎯 A bridge piles up large amounts of funds in a smart contract, which makes it a high-value target for hackers.
• 🔑 A bridge can usually be breached by hackers through two paths, namely weaknesses in cross-network message verification or a leaked private key as in the Taiko case.
• 💸 Throughout 2022, bridge-related hacks caused more than US$2 billion in losses according to Chainalysis.

What Is a Crypto Bridge?

Every blockchain such as Bitcoin, Ethereum, and Solana runs as a separate system that cannot automatically connect with one another, for example to send assets from one network to another. A crypto bridge exists as the connector between these networks, making it possible for users to interact across blockchains. One of its functions is to move the value of an asset from one blockchain to another.

Most bridges use a lock-and-mint mechanism, whose flow consists of three steps:

1. The user locks the original asset, for example ETH, in a contract on its home blockchain.
2. A network of validators or relayers detects that lock and then sends a message to the destination blockchain.
3. A contract on the destination blockchain mints a wrapped version of the token (wrapped token) equal in value to the asset the user locked.

When the user wants to return to the original network, the process is reversed. The wrapped token is removed through a burn process, and then the original asset on the home blockchain is unlocked again. It is that locked original asset that keeps piling up inside the bridge contract.

Learn more about how Bridges work on Pintu Academy: What Are Blockchain Bridges?

A Few Crypto Bridges Projects

There are several major projects that focus on moving assets between blockchains. Three of them are often used as references because their scale and security approaches differ.

1. Wormhole

One of the largest bridges, connecting more than 35 blockchains including Ethereum and Solana, with cumulative transfer value passing US$50 billion as of April 2026 according to its official documentation. Its security rests on 19 validators called Guardians, who must agree at a minimum of 13 out of 19 before a cross-chain message is approved. Wormhole is also a project that once lost US$321 million in 2022, and from that case the project added several layers of protection.

2. LayerZero

A cross-network (omnichain) messaging protocol that lets applications on different networks send messages to one another, including moving tokens. Instead of locking tokens and then minting a wrapped version, LayerZero’s Omnichain Fungible Token (OFT) standard burns the token on the origin network and then mints the original version on the destination network, so there is no pile of wrapped tokens. As of April 2026, LayerZero has been integrated across more than 90 blockchains.

3. Hyperlane

A permissionless interoperability protocol, meaning any blockchain can install it without needing permission from a single centralized party. Its hallmark is modular security through an Interchain Security Module (ISM), where each application can choose for itself how its cross-chain messages are verified. Hyperlane now reaches more than 150 blockchains.

Why Crypto Bridges Are Easy Targets for Hackers

A bridge fundamentally runs on top of a smart contract, and it is this contract that often becomes an easy target for hackers. Attacks can come through various ways, ranging from gaps in the code to social engineering used to steal the keys that grant access to user funds.

1. Large Funds Piled Up in One Place

Because every asset that is moved must first be locked, a popular bridge platform can hold hundreds of millions to billions of dollars in a single contract. For hackers, this is like a giant vault where a single gap is enough to open everything inside. According to Chainalysis, attacks on bridges accounted for around 69% of all crypto funds stolen throughout 2022.

Learn more about Smart Contracts on Pintu Academy: Understanding Smart Contract Technology.

2. Fragile Message Verification

The core work of a bridge is to verify one thing, has the asset really been locked on the origin blockchain before the asset on the destination blockchain is released? If the answer to that question can be faked, then funds can leave without any backing at all.

Reports from Halborn and data from PeckShield show that this message verification layer is the one that most often becomes a bridge’s weak point throughout 2026. The gap can come from a design flaw in the verification code, or it can come from a leaked signing key that lets an attacker create a proof that passes verification, as happened with Taiko.

How Do Hackers Attack a Bridge?

Attacks on bridges generally share a few similar patterns:

• Forged proof (forged proof): The attacker creates a fake withdrawal proof that the bridge treats as valid, and then withdraws assets that were never locked. One case that happened in 2022 was a hack exploiting this kind of gap against a project called Nomad, which caused the loss of more than US$190 million.
• Infinite mint (infinite mint): A signature verification gap lets an attacker mint wrapped tokens without depositing any collateral at all. In this case, Wormhole once lost around US$321 million in 2022.
• Leaked or overly centralized private key: If a signing key that can access funds is stolen, leaked, or held by only a handful of parties, attackers often target the key holders to lure a victim into approving fake transactions. Ronin Bridge lost around US$625 million in 2022 after attackers managed to take over validator keys through social engineering.

In the Taiko case, third-party analysis such as thirdweb’s states the cause was a signing key that leaked to the public. That key, a signing key from a prover system based on Intel SGX technology, was reportedly stored openly inside Taiko’s code repository on GitHub.

With that key, the attacker could register themselves as a legitimate party and then sign fake proofs that passed the bridge’s verification. This means Taiko’s verification logic actually worked as designed, and what failed instead was the protection of its key. This is what sets Taiko apart from cases like Wormhole or Nomad, which hackers breached because of weaknesses in their verification code itself. This finding is still third-party analysis until Taiko releases an official incident report.

The Biggest Hack of 2026 and Key Lessons for Developers

The largest crypto hack throughout 2026 so far is the bridge case from KelpDAO. On 18 April 2026, attackers drained around US$292 million (116,500 rsETH, nearly one-fifth of the total rsETH supply) from KelpDAO’s LayerZero-based bridge. Interestingly, not a single line of smart contract code was hacked.

According to Chainalysis, what was attacked instead was the off-chain (off-chain) verification infrastructure. KelpDAO relied only on a single verifier, and then the attacker infiltrated that verifier’s data source until the bridge was convinced that a token burn had happened on the origin network when in fact it never did. Because each transaction looked valid on the blockchain, ordinary security tools did not catch any suspicious signal in this situation. Chainalysis links this attack to the Lazarus Group, the well-known hackers from North Korea.

A few important things we can take from this case:

• The weak point is not always in the code. KelpDAO proves that the weakest part can appear in supporting infrastructure and trust assumptions, outside the smart contract that is usually audited.
• A single point of trust is dangerous. If a bridge relies only on one verifier or a handful of signers, one compromise is enough to breach everything.
• A fast response can limit the losses. The KelpDAO team managed to block a follow-up attempt worth US$95 million, and part of the perpetrator’s funds was frozen through cooperation among various parties.

The common thread, from KelpDAO to older cases like Ronin and Nomad, is always the same, namely one basic rule that was broken, the asset released on the destination network must be equal to the one locked or burned on the origin network. Once that rule can be gamed by irresponsible parties, the funds piled up in the bridge will be drained immediately, no matter how sophisticated the technology behind it.

Conclusion

For investors in Indonesia, most crypto buying and selling happens through licensed centralized platforms (centralized exchange) supervised by the Financial Services Authority (OJK), so users do not deal directly with the bridge process. Bridge risk only appears when users step into the world of decentralized finance , namely financial services without intermediaries that run on top of blockchain, and have to move assets between networks themselves.

A crypto bridge solves a real problem, namely moving assets between blockchains that were previously separate from one another. However, this design piles up large funds in one place and depends on message verification that is hard to make perfect, whether because of code flaws or because its important keys can leak.

Disclaimer: All information presented in this article is compiled for educational and general informational purposes. This content is not intended as investment advice, a recommendation, an invitation to buy or sell any particular crypto asset, or a basis for financial decision-making. Every investment decision is entirely the reader's responsibility, taking into account their own financial condition, investment goals, and risk tolerance.

FAQ

What is a crypto bridge?

A crypto bridge is a link that moves assets from one blockchain to another. Because each blockchain runs separately, a bridge uses a mechanism of locking the original asset on the origin network and then minting a wrapped version on the destination network.

Why do crypto bridges often get hacked?

A bridge holds large amounts of funds in a smart contract. This makes it one of the main targets for hackers who want to exploit security gaps. In addition, a bridge’s security depends on the process of verifying cross-network messages. A single gap in this layer, whether from a code flaw or a leaked signing key, can let funds leave without any backing.

What is the difference between a bridge and an ordinary exchange?

A centralized exchange brings buyers and sellers together on one platform that is usually supervised by regulators. A bridge does not sell assets, it moves them between blockchains, and generally runs automatically through smart contracts without an intermediary.

How to Buy Tokenized Assets on the Pintu Platform

Besides crypto assets, users can also buy tokenized assets starting from a very affordable amount, namely from Rp11,000 in the Pintu app, so users can invest without large capital. Pintu provides various tokenized assets such as TSLAX, PAXG, XAUT, AMZNx, and other similar assets through the tokenized stock/Tokenized Stocks page.

Before buying tokenized assets in the Pintu app, you need to complete KYC and deposit money through various banks in Indonesia. With Pintu, you can own crypto assets, crypto-based digital gold, and tokenized US stocks directly in one investment app!

Here is how to buy tokenized stock assets such as Tesla on Pintu:

1. Go to the Pintu homepage.
2. Go to the Market page.
3. Search for and select the crypto asset TSLAX.
4. Enter the amount you want to buy, and keep following the next steps.

Pintu is a crypto buying and selling platform licensed and supervised by the Financial Services Authority (OJK), so you can invest with more peace of mind.

References

• Shaurya Malwa, “Taiko Halts Its Ethereum Layer-2 Network After a Bridge Exploit, Token Dives“, CoinDesk, accessed on 26 June 2026.
• Danny Park, “Ethereum Layer 2 Taiko Halts Block Production Following Exploit; Urges Users to Withdraw Funds“, The Block, accessed on 26 June 2026.
• Firekeeper, “Taiko Bridge Exploit: How a Leaked Key Drained $1.7M from an Ethereum L2“, thirdweb Blog, accessed on 26 June 2026.
• Chainalysis Team, “Cross-Chain Bridge Hacks Emerge as Top Security Risk“, Chainalysis, accessed on 26 June 2026.
• Chainlink, “Cross-Chain Bridges and Associated Risks“, Chainlink Documentation, accessed on 26 June 2026.
• Randi Eitzman, Joe Dobson, “Decentralized Robbery: Dissecting the Nomad Bridge Hack and Following the Money“, Google Cloud Blog, accessed on 26 June 2026.
• Rob Behnke, “Explained: The Syscoin Bridge Hack (June 2026)“, Halborn Blog, accessed on 26 June 2026.
• Chainalysis Team, “Inside the KelpDAO Bridge Exploit“, Chainalysis, accessed on 8 July 2026.
• Wormhole, “Wormhole Documentation“, Wormhole, accessed on 7 July 2026.
• LayerZero, “LayerZero Documentation“, LayerZero, accessed on 7 July 2026.