What Are Crypto Bridges? How They Work, Why They Get Hacked, and Safer Alternatives
The crypto world is not one blockchain but many, and they do not naturally talk to each other. Bitcoin cannot see Ethereum, Ethereum cannot see Solana, and an asset native to one chain cannot simply appear on another. Crypto bridges exist to solve that problem, moving value between otherwise isolated networks. They are essential plumbing for a multi-chain world, yet they are also, by a wide margin, the most frequently and expensively hacked part of the entire industry.
This guide explains what crypto bridges actually do, the different ways they work, why they have become such a magnet for attackers, and the safer alternatives Australians can consider. It is general education, not financial advice, and the aim is to help you use bridges with your eyes open, or avoid them where you sensibly can.
What a crypto bridge does
A bridge is a service that lets you move a crypto asset from one blockchain to another. Because you cannot literally send an asset off its home chain, most bridges use a lock-and-mint model. You deposit an asset on the source chain, where it is locked in a smart contract, and the bridge mints an equivalent “wrapped” version on the destination chain. To reverse the process, the wrapped asset is burned and the original is unlocked.
Australians most often meet bridges when moving ETH or stablecoins onto an Ethereum Layer 2 such as Arbitrum, Optimism or Base, or when hopping between larger Layer 1s. Once you are comfortable with the concept, our explainer on ZK rollups also touches on how some scaling networks handle cross-chain movement more securely.
How bridges move value: three underlying mechanics
Behind the marketing, almost every bridge uses one of three basic techniques. Knowing which one you are relying on tells you a lot about where the risk sits.
Lock-and-mint
This is the classic model described above. The original asset is locked on the source chain and a wrapped copy is minted on the destination chain, for example wrapped ETH or a bridged version of USDC. The wrapped token is only worth something because the real asset is sitting locked in the bridge’s contract. If that locked pool is drained, the wrapped token can instantly lose its backing.
Burn-and-mint
Here the token you are moving can be created and destroyed natively on more than one chain. When you bridge, the token is burned (permanently destroyed) on the source chain and an equal amount is minted on the destination chain. There is no locked honeypot and no separate wrapped derivative, because the same asset simply moves supply from one chain to another. Circle’s Cross-Chain Transfer Protocol for USDC works this way, which is why native USDC on one chain is genuinely the same asset as native USDC on another.
Liquidity-pool and atomic-swap bridges
So-called liquidity network or “fast” bridges do not mint anything. Instead they keep pools of the same asset on both chains. You deposit into the pool on the source chain and a liquidity provider pays you out of the pool on the destination chain, taking a small fee. Because nothing has to be minted or wait for a slow official withdrawal, these bridges are quick, but they depend on the pools being deep enough and on the operators behaving honestly.
Canonical bridges versus third-party bridges
There is an important distinction between the canonical (or native) bridge published by a network itself and the many third-party general-purpose bridges that connect dozens of chains.
A canonical bridge is the official route a Layer 2 or Layer 1 uses to accept and release funds. It usually mints the “real”, fully backed version of an asset on that chain, and its security is tied to the chain’s own security. The trade-off is that withdrawing back to the source chain can be slow. On many optimistic rollups a native withdrawal carries a challenge period of around seven days before the funds are released.
Third-party bridges exist partly to route around that wait and to connect chains that have no direct official link. They are faster and more flexible, but you are trusting an extra layer of code, validators and operators that the chains themselves did not build. Historically it is these general third-party bridges, not the canonical ones, that have suffered the largest losses.
Trust models: who actually secures the bridge
Every bridge answers one question: who decides that a deposit on chain A really happened, so funds can be released on chain B? The answer defines the trust model.
Trusted (custodial) bridges
A trusted bridge is run by a company or centralised operator that takes custody of your deposit and issues the wrapped asset. You are trusting that operator not to lose or misuse the funds. Some exchange withdrawals effectively act as trusted bridges, which is one reason many Australians prefer to withdraw directly from a local exchange onto their target chain where possible.
Trustless (decentralised) bridges
A trustless bridge relies on smart contracts and a network of validators or relayers rather than a single company. In theory this removes the need to trust one operator, but it shifts the risk onto the code and the validator set. In practice, the security often comes down to a multisig (a handful of signers), a set of external validators, or an oracle that reports events from one chain to another. If enough of those signers or validators are compromised, or the oracle is fooled, the bridge can be drained even though no single company is in charge.
Messaging protocols: the newer approach
The current wave of cross-chain infrastructure focuses on generic messaging rather than just token bridging. Protocols such as LayerZero and Chainlink’s Cross-Chain Interoperability Protocol (CCIP) aim to pass arbitrary messages between chains securely, so that applications, not just tokens, can talk across networks. The goal is to reduce reliance on a single trusted party by splitting responsibilities between independent components. Our LayerZero deep dive explains one prominent approach to this omnichain messaging in detail.
Why bridges get hacked so often
Bridges have lost billions of dollars to attackers, more than almost any other category in crypto. Several structural reasons explain why:
- Honeypots of locked funds. A busy bridge holds enormous value locked in its contracts, making it an irresistible target.
- Complex, novel code. Bridges must coordinate across two chains with different rules, which makes their smart contracts complicated and easy to get subtly wrong.
- Validator and key compromise. Many high-profile bridge hacks came from attackers stealing the private keys that controlled the bridge’s validators, letting them mint or release funds fraudulently.
- Weakest-link security. A bridge is only as safe as its least secure component, and a single flaw can drain the whole system.
The result is that bridges concentrate risk in exactly the place where the most money sits. This is why experienced users treat bridging as a moment of heightened caution rather than a routine click.
Notable bridge hacks, and what they teach us
The best way to understand bridge risk is to look at what has actually gone wrong. These are among the largest and most widely documented incidents. The figures are approximate and based on the value at the time of each hack; they are included to illustrate the scale of the problem, not to frighten anyone away from learning how the technology works.
| Bridge | Year | Approx. loss (USD) | Root cause |
|---|---|---|---|
| Ronin (Axie Infinity) | 2022 | ~US$620m | Validator private keys compromised; attacker controlled a majority of signers |
| Poly Network | 2021 | ~US$610m | Contract flaw let the attacker reassign control; funds were later returned |
| Wormhole | 2022 | ~US$320m | Signature verification flaw allowed fake mint approvals |
| Nomad | 2022 | ~US$190m | Faulty upgrade meant almost anyone could copy a transaction and drain funds |
| Harmony Horizon | 2022 | ~US$100m | Multisig with too few signers; keys were compromised |
To put the scale in Australian terms, the Ronin loss of roughly US$620m was worth on the order of A$900m at the time, and the Wormhole loss of around US$320m was close to A$450m. These were some of the busiest bridges in crypto, which is precisely why they held enough value to make an attack worthwhile.
Two patterns stand out. First, several hacks came from compromised keys or thin multisigs rather than clever maths, meaning the human and operational security around the bridge failed. Second, the Nomad and Wormhole incidents show how a single code or verification bug can let an attacker forge the proof that a deposit happened, minting tokens out of thin air. The Poly Network case is the rare happy ending: the attacker returned most of the funds, but you should never plan around that generosity.
Wrapped assets: the hidden dependency
When a lock-and-mint bridge is drained, the damage does not stop at the bridge. The wrapped tokens it issued are only as good as the collateral locked behind them. If that collateral disappears, holders are left with a token that can no longer be redeemed for the original asset, even though it may still appear in their wallet and trade at a fraction of its old price.
This is why a bridge hack is not the same as a fall in the value of your coins. A market dip affects everyone equally; a bridge drain can specifically destroy the backing of one particular wrapped asset. It is also why native, burn-and-mint stablecoins are increasingly popular: there is no wrapped derivative to lose its backing in the first place. Our comparison of USDT, USDC and AUDC stablecoins for Australians covers which stablecoins support this native multi-chain model.
Bridging versus the alternatives
Bridging is not the only way to end up with an asset on the chain you want. Here is how the main options compare on the things that matter.
| Method | Trust required | Speed | Typical cost | Main risk |
|---|---|---|---|---|
| Withdraw direct from exchange | The exchange | Fast | Withdrawal fee | Exchange custody and outages |
| Canonical (native) bridge | The chain itself | Slow to withdraw (challenge period) | Gas only | Long wait; contract bugs |
| Third-party general bridge | Extra validators/operators | Fast | Bridge fee + gas | Hacks; fake bridge sites |
| Native stablecoin (burn-and-mint, e.g. CCTP) | The issuer’s protocol | Fast | Gas only | Issuer/protocol risk |
For many everyday tasks, the simplest and lowest-risk route is to skip bridging entirely: withdraw the asset straight from your exchange onto the chain you need, or use a stablecoin that is native on both chains.
How to use a bridge more safely
If you do need to bridge, a few habits reduce your exposure:
- Prefer official, native bridges. Use the canonical bridge published by the network itself rather than an unfamiliar third party promising better rates.
- Check the URL obsessively. Fake bridge sites are a classic scam. Bookmark the real address and never follow links from social media or ads.
- Confirm the destination chain and address. Sending to the wrong chain or an unsupported address is one of the most common and unrecoverable ways to lose funds.
- Move a small test amount first. Confirm the funds arrive before sending the bulk, especially the first time you use a particular bridge or route.
- Understand and revoke approvals. Bridges ask you to approve token access, which attackers abuse. Grant only the amount you need rather than an unlimited allowance, and get into the habit of revoking old approvals afterwards. Our guide to wallet drainers and approval phishing explains how to avoid granting a malicious contract permission to your assets.
- Use hardware wallets. Signing bridge transactions from a hardware wallet, as covered in our hot versus cold wallets guide and our review of the Ledger hardware wallet for Australians, adds a strong layer of protection.
Common mistakes
Most bridge losses that are not caused by a protocol hack come down to a handful of avoidable errors:
- Using an unofficial or fake bridge site. Scammers buy ads and clone real bridge front-ends. Always start from a bookmark or the network’s official documentation.
- Not checking the destination chain. Bridging to the wrong network, or one your wallet is not set up for, can strand or lose your funds entirely.
- Skipping the test transaction. Bridging a large amount without a small trial run first turns a small mistake into an expensive one.
- Leaving unlimited approvals. An open-ended token allowance is a standing invitation if the contract is later exploited or you interact with a malicious clone.
- Assuming a bridge hack is insured. It is not. In Australia there is no deposit guarantee for crypto and no regulator that will refund you if a bridge is drained.
Safer alternatives to bridging
Often the safest bridge is the one you never use. Alternatives worth considering include:
- Withdraw directly from an exchange. Many Australian and global exchanges, including CoinSpot, Swyftx, Independent Reserve, CoinJar and Kraken, let you withdraw an asset straight onto your target chain, sidestepping third-party bridges entirely. Our guide to Australian exchanges compares the platforms.
- Native stablecoin transfers. Some stablecoins can be issued natively on multiple chains using a burn-and-mint model, letting you move value without a wrapped token or a locked honeypot at all. This is increasingly how stablecoin payments in Australia move across networks.
- Stay on one ecosystem. If your activity can happen entirely within one chain and its Layer 2s, you may not need to bridge across ecosystems at all. Choosing the right home base is easier once you understand the trade-offs in our guide to crypto wallets for Australians.
The Australian tax angle
Whether bridging itself is a taxable event in Australia is not always clear-cut, and it can depend on whether the ATO views the wrapped token as a different asset from the original. Wrapping and unwrapping assets can, in some interpretations, be treated as disposals for capital gains tax purposes, which would mean a bridging transaction could crystallise a gain or loss in AUD even though you feel like you still hold “the same” asset. Because the treatment is uncertain and fact-specific, it is worth reading our DeFi tax guide and the broader crypto tax rules, keeping careful records of every bridge transaction, and confirming your position with a registered tax agent.
Frequently asked questions
Are crypto bridges safe to use?
Bridges are among the highest-risk parts of crypto and have been the target of some of the largest hacks on record. They can be used more safely with official bridges, careful URL checks, small test amounts and a hardware wallet, but the risk is never zero.
Why do hackers target bridges specifically?
Bridges lock huge amounts of value in complex smart contracts and often depend on a small set of validators or keys. That combination of concentrated funds and a large attack surface makes them exceptionally attractive to attackers.
Is a wrapped token the same as the real asset?
Not exactly. A wrapped token is a stand-in that is only backed by the original asset locked in a bridge contract. If that locked collateral is stolen or the bridge fails, the wrapped token can lose its backing and become unredeemable, even though the “real” asset on its home chain is unaffected. Natively multi-chain assets, which are minted and burned rather than wrapped, avoid this dependency.
If a bridge gets hacked, can I get my money back?
Usually not. Most bridge exploits result in permanent loss for holders of the affected assets. A few, such as Poly Network, ended with the attacker returning funds, but that is the exception. In Australia there is no deposit guarantee for crypto and no financial regulator that will make you whole, unlike a bank transfer gone wrong.
Can I avoid bridges altogether?
Often, yes. Withdrawing an asset directly from an exchange onto your target chain, using natively multi-chain stablecoins, or simply staying within one ecosystem can all remove the need for a third-party bridge.
General information only. This article is general information and education, not financial or tax advice. Cryptocurrency is highly volatile and you can lose money. Crypto Australia Guide does not hold an Australian Financial Services Licence (AFSL). Always do your own research and consider speaking to a licensed financial adviser or registered tax agent about your personal circumstances before investing. Tax treatment depends on your individual situation and current ATO guidance.
