Cross-chain refers to moving assets or data between separate blockchains, which cannot natively talk to each other. Bitcoin has no way to read Ethereum's ledger, so anything crossing between them needs a system standing in the middle.
Those systems have been the most reliably exploited component in crypto. Chainalysis estimated that roughly $2 billion was stolen from cross-chain bridges across 13 separate incidents in 2022, accounting for about 69% of all crypto stolen that year, and the pattern has continued since.
Why blockchains cannot talk to each other
Each blockchain is a closed system. Its nodes verify its own transactions against its own rules. Observing another chain is not something they can do at all.
Sending Bitcoin to an Ethereum address therefore does not work. The two use different address formats, different consensus rules, and entirely separate ledgers. Nothing physically moves between them, because there is no shared space for it to move through.
Cross-chain infrastructure works around that isolation. Every approach involves trusting something.
How bridges actually work
Despite the name, nothing travels across. Lock-and-mint is the standard mechanism.
- You send an asset to a contract on the source chain, which locks or burns it.
- A verifier observes that event and confirms it happened.
- A matching amount of a wrapped token is minted on the destination chain.
Reverse the process and the wrapped token is burned, releasing the original.
Losses happen at step 2. That verifier might be a set of validators holding keys, a multi-signature wallet, or an oracle network. Whatever it is, it decides what the destination chain believes happened on the source chain. Anyone controlling it can lie.
The main approaches
| Approach | How it works | What you trust |
|---|---|---|
| Lock and mint bridge | Asset locked on chain A, wrapped version minted on chain B | The verifier set holding the locked funds |
| Liquidity network | Pools on both chains, you draw from the destination pool | Pool solvency and the relayer |
| [Atomic swap](/en/cryptopedia/atomic-swap) | Direct peer-to-peer trade using hash timelock contracts | Nothing beyond the two chains' own code |
| Native issuance | Issuer burns on one chain and mints on another, as with Circle's CCTP | The issuer |
| Messaging protocol | General data passing between chains, not only assets | The verifier network attesting to messages |
Only atomic swaps require no trusted third party, and they need a counterparty wanting the exact opposite trade at the same moment, which is why they stayed niche.
The major bridge failures
Instructive across all of them is that the smart contracts usually were not the problem.
- Poly Network, August 2021. Roughly $611 million taken across three chains. The attacker returned virtually all of it.
- Wormhole, February 2022. About $320 million, after a signature verification flaw let an attacker mint 120,000 wrapped ETH without depositing collateral. Jump Crypto replaced the funds from its own reserves.
- Ronin, March 2022. Approximately $625 million in ETH and USDC, the largest bridge exploit to date. Attackers linked to North Korea's Lazarus Group obtained five of nine validator keys, partly through a fake job offer sent to an employee. Nobody noticed for six days.
- Nomad, August 2022. Around $190 million, after a faulty upgrade made the system treat essentially every message as valid, producing a free-for-all as others copied the exploit.
- Kelp DAO, April 2026. Roughly $292 million, and no contract code was exploited at all. Attackers compromised two RPC nodes and knocked out a third, forcing the bridge to rely on infrastructure they controlled. The bridge used a single verifier with no independent second opinion, so the false data was accepted.
Four years apart, on entirely different technology, the failure lands in the same place. The verifier.
Wrapped tokens, and what you actually hold
Bridging usually leaves you holding a wrapped token, which is a claim rather than the asset itself, and not something you can send to a native crypto address on the original chain.
WBTC on Ethereum is not Bitcoin. It is a token backed by Bitcoin held by a custodian, and its value depends on that custodian remaining solvent and honest. Same for most bridged assets: the wrapped version is only as good as whoever holds the original.
Practically, this matters. Sending WBTC to a native Bitcoin address loses it. Two bridged versions of the same asset from different bridges are not interchangeable, either.
How to reduce the risk
- Prefer native issuance where it exists, since Circle's CCTP and similar mechanisms remove the wrapped-token layer.
- Check the verifier design. A single verifier or a small multi-signature is the weak point. Independent verification by separate parties is stronger.
- Bridge small amounts and only when necessary. Every bridge transaction is exposure to a system that has historically failed.
- Check total value locked and track record, since a bridge holding billions is a target proportionate to that amount.
- Confirm which wrapped version you are receiving and whether your destination platform supports it.
- Never leave large balances sitting in bridge contracts.
Where mb.io fits
Isolation between chains is why bridging exists, and it is a problem a centralized exchange sidesteps. A regulated exchange sidesteps much of that problem, since assets on different networks can be traded through one account without moving anything through a bridge contract.
mb.io is a regulated crypto spot exchange backed by MultiBank Group, a financial institution founded in 2005 that serves more than 2 million clients across 100+ countries.
- Regulated by VARA in the UAE and AUSTRAC in Australia
- 10/10 security score from Hacken, an independent blockchain security auditor
- Institutional-grade MPC custody powered by Fireblocks, with segregated client funds
- Deposit and withdrawal flows that name the network explicitly before funds move
- Buy, sell, and swap in three steps, from sign-up to purchase
- 24/7 customer support, on web and on the iOS and Android apps
Open your account and start trading on mb.io.
Frequently asked questions
What does cross-chain mean?
Moving assets or data between separate blockchains that have no native way to communicate. It requires infrastructure standing between the two chains and attesting to what happened on each.
Why do bridges get hacked so often?
Because they concentrate large amounts of value behind a verification step that is usually simpler than the money it guards. Ronin, Wormhole, Nomad, and Kelp DAO all failed at the verifier rather than in token logic.
Is a bridge the same as a cross-chain swap?
Not quite. A bridge moves an asset to another chain, usually creating a wrapped version. Exchanging one asset for a different one across chains is a cross-chain swap, which sometimes uses a bridge underneath.
What is a wrapped token?
A token on one chain representing an asset held on another. WBTC on Ethereum represents Bitcoin held by a custodian. Its value depends entirely on that custodian holding the backing asset.
Are atomic swaps safer than bridges?
Structurally, yes, since neither party can take the other's funds and no third party holds anything. They require a counterparty wanting the exact opposite trade at the same time, which is why they never scaled.
How much has been stolen from bridges?
Chainalysis estimated roughly $2 billion across 13 incidents in 2022 alone, about 69% of all crypto stolen that year. Losses continued afterwards, including approximately $292 million from Kelp DAO in April 2026.
Do I need to bridge to use multiple blockchains?
Not necessarily. Buying an asset natively on the chain you want, through an exchange that supports that network, avoids bridge exposure entirely.
