What is a bridge hack, and why do they keep happening?

A cross-chain bridge can concentrate an enormous pool of user funds in a single set of contracts, and for a stretch of recent years bridges were among the most heavily exploited targets in crypto. The pattern repeats often enough that 'bridge hack' is now its own genre of headline. Why it keeps happening is not a mystery once you see what a bridge does.

What is a bridge, and what is a bridge hack?

A blockchain bridge is software that lets an asset move between two chains that otherwise cannot talk to each other, and a bridge hack is an attack that tricks or breaks that software into releasing funds it should not. Separate networks like Bitcoin, Ethereum and Solana have no native way to send value to one another, so a bridge stands in the middle: it accepts your coin on one chain and makes an equivalent usable on the other.

Most bridges work by locking and minting. You deposit a token on the source chain, the bridge locks it in a contract, and it mints a matching 'wrapped' token on the destination chain. To return, you burn the wrapped token and the bridge releases the original from the lock. The locked pool on the source side is the honeypot: whoever tricks the bridge into releasing it walks away with the collateral backing every wrapped token.

Why do bridges concentrate so much risk?

Bridges concentrate risk because they pool the collateral for a whole chain's worth of wrapped assets in one place, and they must trust something to decide when a release is legitimate. That combination of a large, static pool of funds and a trust assumption that can be forged is why bridges are targeted more than most contracts. One successful attack can reach the backing for many assets at once.

Why do bridge hacks keep happening?

Bridge hacks keep happening because a bridge has to verify messages from another chain, and that verification is both hard to get right and catastrophic to get wrong. Every bridge answers one question on each withdrawal: did a real deposit happen on the other side? The ways of answering it all carry failure modes. Get the check wrong by one line of code or one stolen key, and the lock opens for a request no deposit ever backed.

The main ways a bridge breaks

Bridge failures cluster into a few repeating shapes. The first is a smart-contract flaw: a bug in the verification logic lets a forged withdrawal pass as genuine, so the contract releases funds against a deposit that never happened. The second is compromised keys: many bridges rely on a small set of signers to approve transfers, and an attacker who steals enough of those keys can authorise their own withdrawals. The third is a fake-proof flaw: the bridge accepts a forged proof of a deposit because its signature check can be tricked. Different incidents, one theme: the release mechanism trusted something it should not have.

Does an audit mean a bridge is safe?

No. An audit lowers risk but does not remove it: it is a point-in-time review of the code as written, not a guarantee against a later upgrade that adds a bug, or a key stolen off-chain. Several bridges that were later exploited had been audited beforehand. An audit is one input into how much to trust a bridge, not a clean bill of health — who holds the keys can matter just as much.

How to watch bridge risk on Northtape

Northtape's Risk Radar treats protocol and chain risk as one of its four standing lenses, and bridge incidents are exactly what it is built to surface early. The lens is a keyword screen: it matches headlines carrying the vocabulary of on-chain failure (exploit, hack, bridge, vulnerability, reentrancy, drained and related terms), then shows the latest matches with a count of how many landed in the last 48 hours. That count is an activity level, not an invented risk score, and the screen is informational only. The point is to see a bridge story while it is still developing, not to be told what to do about it.

FAQs

What is a wrapped token? It is a placeholder token a bridge issues on a destination chain to stand in for an asset locked on another chain. One wrapped token is meant to be redeemable for one of the originals held in the bridge's lock, so its value depends entirely on that backing staying intact.

Are all bridges equally risky? No. Bridges differ in how they verify transfers: some lean on a small group of trusted signers, others on on-chain proofs, and the size of that trust assumption is a large part of the risk. A bridge secured by a handful of keys concentrates more trust than one that verifies deposits cryptographically.

Why not just avoid bridges entirely? Many people do, and it is a legitimate choice. Bridges exist because using an asset across chains otherwise means selling on one and rebuying on another, which is slower and can cost more. A bridge trades that friction for a trust assumption, and the risk is the price of the convenience.

How can I tell if a wrapped asset is still fully backed? You generally cannot from the price alone, because a wrapped token can trade near its peg right up until a hack is discovered. Watching for exploit and bridge headlines, and whether the bridge has paused withdrawals, is a more timely signal than the token's quoted price.

None of this is investment advice. It describes how cross-chain bridges work and why they are attacked, not a recommendation to use or avoid any particular bridge, chain or asset. Bridge security shifts as code and operators change, so treat any specific bridge as something to check freshly rather than to trust on reputation.