What is a crypto bridge?

A crypto bridge is a service that moves assets from one blockchain to another. It usually does this by locking the original coins on the first chain and creating a matching token on the second. Bridges are widely used and have also been the scene of some of the largest thefts in crypto.

Why are bridges needed?

Each blockchain is its own ledger with its own rules. Bitcoin's network knows nothing about Ethereum's, and neither can read the other's records. A bitcoin cannot simply be sent to an Ethereum address.

People still want to move between them. Someone may hold ether on Ethereum and want to use an app on Solana or on a cheaper layer 2 network. A bridge fills that gap.

How does a bridge work?

The common method is called lock and mint:

1. The user sends coins to the bridge on the first chain, where they are locked.
2. The bridge confirms the deposit.
3. A matching token is created, or minted, on the second chain and sent to the user.

The new token is called a wrapped token. It is an IOU for the locked original. Wrapped bitcoin on Ethereum is the best-known example. To go back, the user returns the wrapped token, which is destroyed, and the original is released.

The weak point is step two. Something has to confirm that the deposit happened. Some bridges rely on a small group of operators who sign off together. Others use smart contracts that check proofs from the other chain.

Why have bridges been hacked so often?

A bridge gathers a large amount of locked value in one place, and the wrapped tokens are only worth something while that value stays put. An attacker who can release the locked coins, or mint wrapped tokens with nothing behind them, can take a great deal at once.

Two 2022 cases show both routes. In February 2022, a flaw in the Wormhole bridge's code let an attacker create wrapped ether without depositing any, a loss of about $320 million. In March 2022, attackers took about $620 million from the Ronin bridge, which served the game Axie Infinity, after gaining control of most of the keys used to approve withdrawals. The FBI attributed the Ronin theft to hackers linked to North Korea.

More on these patterns is in how crypto gets hacked.

What are the risks for users?

• The wrapped token can break. If a bridge is drained, the tokens it issued may no longer be redeemable.
• Fake bridges. Lookalike websites ask users to connect a wallet and then empty it. See phishing and wallet drainers.
• Wrong network. Sending tokens to an address on a chain that does not support them can strand the funds.
• Fees and delays. A transfer costs network fees on both chains and can take from minutes to days.