Bridge Hacks: Why Bridges Get Drained and How to Cut Your Exposure

Introduction

A bridge moves value between blockchains, and many bridges do it by holding assets on one chain while issuing a matching token on another. Whatever holds those assets can become a very large pool of money in one place, and anyone who can convince the bridge that a valid instruction has arrived can empty it. Three of the five largest records in DefiLlama's hacks database, read on 19 October 2026, are bridge incidents.

This page is the incident record for our bridge guides. It covers Poly Network in 2021; Wormhole, Ronin, Harmony's Horizon bridge, Nomad and BNB Chain's Token Hub in 2022; Multichain in 2023; a second, smaller Ronin incident in 2024; and Kelp's rsETH bridge and the Liquid Network in 2026. For how bridges work, and which trust model each type carries, start with our guide to how bridges work.

The dollar size of each incident is DefiLlama's, read on 19 October 2026 from its public hacks database. Causes, token amounts and what happened next come from the incident's own post-mortem or from the statement of a party directly involved, named and dated in the same sentence. Where a party's own account could not be read, the page says so rather than filling the gap from press reports, and where the post-mortem gives a different number from DefiLlama, both appear.

The second half of the page is practical. It turns the four failure classes into habits you can apply before, during and after a transfer: when to avoid a bridge altogether, what to read before trusting one, how long to hold a wrapped token, and what to do if a bridge you used is drained. A short section covers custody after you arrive, because a bridge failure and a stolen key are different problems with different defences.

You may also hold a bridged token without having used a bridge yourself. Wrapped versions of assets reach wallets through swaps and lending markets, and their value depends on the bridge that issued them as much as on the asset they represent. The record below matters in that case too, because in several of these incidents the loss fell on everyone holding the bridge's wrapped tokens, not only on the people moving funds that day.

One limit applies throughout. Nothing on this page makes any bridge safe, and no bridge named here is recommended as one. The aim is narrower: to reduce the share of your money that depends on a single set of signers, a single piece of verification code or a single upgrade going right.

Why Bridges Hold So Much to Steal

The losses on this page are large for a structural reason. A bridge gathers, in one place, the collateral behind every token it has issued elsewhere, and it releases that collateral on the strength of a message.

A vault with a message system attached

Most bridges in the record use a lock-and-mint design. Assets deposited on the source chain are locked in a contract, and a wrapped token representing them is minted on the destination chain. Kelp's rsETH worked this way: according to the incident report on Aave's governance forum of 20 April 2026, rsETH locked in an adapter contract on Ethereum backed the copies minted on other networks.

The bridge mints or releases only when it accepts a message saying the matching event happened on the other chain. Its security therefore comes down to who, or what, is allowed to say so. That can be a group of signers, such as validators, guardians or a multisig; a single verifier; or code that checks a cryptographic proof. Every incident below is a case where that judgement was captured, fooled or bypassed.

What a wrapped token is worth afterwards

A wrapped token is a claim on the assets the bridge holds. When those assets leave, the claims outnumber the backing, and the loss falls on everyone holding the token, not only on the people bridging that day. In Kelp's case, the same Aave report says the adapter's balance fell from 116,723 rsETH to 223 rsETH within one block, leaving the copies on other networks largely unbacked.

The damage can also be invisible at first. Blockstream's assessment of the Liquid incident, published on 23 September 2026, says that once the unbacked LBTC had entered the accepted chain state it was indistinguishable from genuine LBTC to every other node. The assessment adds that the anomaly could not have been flagged at the time by inspection alone.

How the losses are counted

DefiLlama's hacks database marks each incident with a bridge flag, and the shares on this page are computed from that flag. Over the whole database, read on 19 October 2026, bridge-flagged incidents account for $3,690.0 million of $21,068.1 million, or 17.5%, across 98 records. In the same database, read on 19 October 2026, the bridge-flagged share of each calendar year swings widely: 52.4% in 2022, 2.2% in 2024 and 1.4% in 2025. One calendar year is therefore a poor guide to the next, which is why the figure in the lead uses a trailing 12-month window with its dates stated.

Two cautions apply to that window. In DefiLlama's database, read on 19 October 2026, two incidents, the Liquid Network and Kelp's rsETH bridge, account for 80.2% of the bridge-flagged losses from 19 October 2025 to 18 October 2026, so the share rests on very few events. And the database's bridge-flagged records rose from 11 in 2025 to 47 in 2026 up to its latest record, dated 16 October 2026, which may reflect a change in how incidents are tagged as much as a trend. The amounts are DefiLlama's own figures, and the post-mortems below sometimes give different ones.

The Incident Record, 2021 to 2026

The table lists the incidents this page covers, with the amount and technique DefiLlama records for each, read on 19 October 2026. The last column gives the failure class this page assigns, explained in the next section. The sections after the table set out what each incident's own post-mortem says happened.

Poly Network, August 2021

DefiLlama records $611.0 million taken from Poly Network on 10 August 2021 and classifies the method as improper access control. Poly Network's own account, published in September 2021, says over $610 million in crypto assets were stolen and returned within 15 days, after the attacker announced on 11 August that they were ready to return them. By 26 August, it says, all of the affected assets had been restored. Apart from just over 33 million USDT that Tether froze and released to Poly Network on 25 August 2021, the return depended on the attacker's choice, not on anything the bridge could enforce.

Wormhole, February 2022

DefiLlama lists the Wormhole loss of 2 February 2022 under Portal, Wormhole's token bridge, at $326.0 million and classifies it as a signature verification flaw. Wormhole's incident report of 4 February 2022 says the attacker exploited a bug in the Solana-side contract to mint 120,000 wrapped ether with no ether behind them, then sent 93,750 of those tokens back to Ethereum and withdrew real ether.

The contract had not checked that an account passed to it was the genuine system account, so a fake one could make it believe the guardians' signatures had been verified. To stop further damage, the node operators stopped relaying messages and then upgraded the contract. Jump Crypto recapitalised the contract so that all Wormhole-wrapped ether was fully backed again, and the report gives the incident's total duration as about 16 hours. It also notes that a fix had been pushed to the public repository on 13 January 2022 as part of a routine toolchain upgrade, but had not yet been deployed.

Ronin, March 2022 and August 2024

DefiLlama records $624.0 million taken from the Ronin bridge on 23 March 2022, the largest bridge-flagged amount in its database, and classifies it as a validator key compromise. Ronin's community alert, first published on 29 March 2022, says 173,600 ether and 25.5 million USDC were drained in two transactions. According to the alert, the chain then had nine validators and needed five signatures to approve a withdrawal. The attacker controlled Sky Mavis's four validators and obtained the fifth through an Axie DAO arrangement that had ended in December 2021 without its access being revoked.

Ronin said the breach was found on 29 March 2022, six days later, after a user could not withdraw 5,000 ether. Ronin raised the threshold to eight of nine, and its update of 14 April 2022 said the FBI had attributed the attack to North Korea's Lazarus Group. Ronin said on 28 June 2022 that all users had been made whole, with Sky Mavis reimbursing the remaining liabilities, while, it said, 56,000 ether belonging to the Axie DAO treasury would remain undercollateralised.

DefiLlama also lists a second Ronin bridge incident on 6 August 2024, at $12.0 million, classified as an uninitialised proxy. Ronin said on X on 6 August 2024 that a bridge upgrade deployed that day had made the bridge misread the vote threshold its operators must reach, that its withdrawal limit had capped what could be taken, and, later that day, that the white hats who took the funds had returned them in full.

Harmony's Horizon bridge, June 2022

DefiLlama records $100.0 million taken from Harmony's Horizon bridge on 23 June 2022 and classifies it as a validator key compromise. Harmony's post of 24 June 2022, updated until 14 July, says its team found no evidence of a breach of its smart contract code but did find that private keys had been compromised. The keys were encrypted and stored by Harmony, with no single machine holding more than one key in plain text, yet the attacker accessed and decrypted several of them, including those used to sign the withdrawals. Harmony then moved the Ethereum side of the bridge to a 4-of-5 multisig, and on 14 July it said it was preparing options for about 50,000 affected wallets to put to a community vote.

Nomad's bridge, August 2022

DefiLlama records $190.0 million taken from Nomad's bridge on 1 August 2022 and classifies it as a forged proof. Nomad's root cause analysis of 5 August 2022 says an implementation bug let any message be forged as long as it had not already been processed. The analysis says the faulty code arrived in a contract upgrade on 21 June 2022, after which a message that had never been proven could pass the very check meant to stop it.

Nomad says the change had been made on 26 May 2022, during an audit, as part of audit-related clean-up. Nomad's watchers were built to respond to a compromised updater key, so they did not react: the forged messages needed no fraudulent updater signature at all. A monitor built for one failure class can be blind to the next.

BNB Chain's Token Hub, October 2022

DefiLlama records $570.0 million for the BNB Chain bridge exploit of 6 October 2022 and classifies it as a proof verifier bug. BNB Chain's update of 7 October 2022 says the exploit hit BSC Token Hub, the native bridge between BNB Beacon Chain and BNB Smart Chain, through a sophisticated forging of a low-level proof in a common library, and that 2 million BNB were withdrawn. Stopping it meant contacting community validators one by one, which BNB Chain said was slowed by its 26 active validators being spread across time zones. It added that the vast majority of the funds remained under control, and that on-chain governance votes would decide whether to freeze the hacked funds and whether to use BNB Auto-Burn to cover the rest. Who pays for a bridge failure, in other words, was to be settled by a vote.

Multichain, July 2023

DefiLlama records $126.0 million taken from Multichain's bridge on 7 July 2023, across Moonriver, BNB Chain and Fantom, and classifies it as a validator key compromise; it also lists three smaller Multichain incidents, dated between July 2021 and February 2023. The Fantom Foundation, now publishing as Sonic Labs, put the July 2023 depletion at over $210 million across several chains in its statement of 4 March 2024, and said Fantom's ecosystem bore about a third of the losses.

In that statement the Foundation said the Multichain team had been absent and uncooperative since the exploit, and that Multichain and its founder were subject to an active investigation in Kunming, China. It also said the High Court of Singapore had granted it a default judgment against the Multichain Foundation on 30 January 2024, and that it would ask the court to wind the foundation up. Multichain's own announcements were made on X and are not restated here.

Kelp's rsETH bridge, April 2026

DefiLlama records $293.0 million for Kelp's rsETH bridge on 18 April 2026 and classifies it as cross-chain message spoofing. LayerZero Labs, whose verifier attested the forged message, gives the loss as 116,500 rsETH, approximately $292 million, in its incident report of 20 May 2026. In that account the breach began on 6 March 2026, when an attacker socially engineered a LayerZero Labs developer, reached its RPC infrastructure and poisoned internal RPC nodes, the servers that answer queries about blockchain state.

A denial-of-service attack on an external RPC provider then left the verifier relying on the poisoned nodes, and it attested a message that never happened. LayerZero Labs says the route needed only that one verifier, so no second check could catch the forgery, and Aave's governance forum report of 20 April 2026 also describes the route as 1-of-1. LayerZero Labs adds that Mandiant, CrowdStrike and independent researchers attribute the attack to the North Korean group TraderTraitor, also known as UNC4899, and that, as of its report of 20 May 2026, its verifier refuses to be the only required attestor on any channel.

The released rsETH did not stay idle. The Aave report says the attacker supplied much of it as collateral on Aave, on Ethereum and on Arbitrum, and borrowed against it. That left Aave with roughly 84,000 ETH of bad debt, according to Aave V3 pool data read through Etherscan on 13 October 2026, the figure the Aave incident record on our Aave page also carries.

Liquid Network, September 2026

DefiLlama records $320.0 million for the Liquid Network on 6 September 2026, the largest bridge-flagged amount of the trailing year, and classifies it as an unbacked cross-chain mint. Liquid is a Bitcoin sidechain on which LBTC is meant to be backed one to one by bitcoin held in a federation's reserve. Blockstream's assessment of 23 September 2026 says an attacker exploited a flaw in how Liquid's software cached the results of range-proof checks, which let one transaction pass validation although its value was not backed by its inputs. The assessment says that transaction created about 4,000 LBTC with no bitcoin behind them.

The assessment says the attacker then withdrew about 4,000 bitcoin through SideSwap, a federation member authorised to process peg-outs, and that with other peg-outs processed before the network was halted the reserve fell from about 4,205 bitcoin to 197. According to the assessment, the flaw had been introduced by the August 2026 fix for an earlier caching bug. The attacker returned 3,400 bitcoin on 7 September, and about 602 remained outstanding when the assessment was published. On 19 October 2026, Liquid's blog still carried a notice that LBTC peg-out operations remained paused.

The assessment also records a control that failed alongside the code. According to the assessment, SideSwap acknowledged that it had kept its peg-out key online and had forwarded each payout to the requesting customer automatically, in the same Bitcoin block, although the federation's charter, as the assessment quotes it, tells members to keep the bitcoin receiving wallet offline. The assessment adds that SideSwap stated a delayed, manually reviewed forwarding process would have kept the released bitcoin recoverable.

Four Ways Bridges Fail

The record falls into four classes. They overlap, since Nomad's verification bug arrived in an upgrade, but each one points to a different question you can ask before you trust a bridge with money.

Key compromise: the signers are the target

DefiLlama classifies the Ronin and Harmony losses, and Multichain's loss of July 2023, as validator key compromises. A bridge run by signers accepts whatever enough of them approve, so an attacker who controls enough keys can approve a withdrawal that never had a deposit behind it. Ronin's alert of 31 March 2022 named the root cause plainly: the small validator set made the network much easier to compromise.

The number of signers matters less than their independence. Ronin needed five of nine signatures, but one company ran four validators and still had access to a fifth (Ronin, 29 March 2022). Harmony held its bridge keys itself, encrypted and separated across machines, and the attacker decrypted several anyway. The question to ask: who runs each signer, how many must agree, and whether one breach could reach enough of them.

The same questions apply to a multisig you run yourself, which our guide to multisig risks and mistakes works through. Key theft also tends to start with people rather than code: Ronin said on 30 March 2022 that all evidence pointed to its attack being socially engineered, and LayerZero Labs says the Kelp breach began when one of its developers was socially engineered. The personal side of that threat is covered in our operational security guide.

Verification bugs: the check that failed

In this class nobody steals a key; the bridge is talked into accepting a message it should have refused. Wormhole's contract could be shown a fake system account. Nomad's upgrade let unproven messages through, BNB Chain's Token Hub accepted a forged proof, and Liquid's caching flaw let an invalid transaction pass. And DefiLlama classifies Poly Network's loss as improper access control: a bridge permitting an action it should have refused.

Kelp's case shows that a verifier can be fooled without being broken. In LayerZero Labs' account, the attacker fed its verifier false data from poisoned RPC nodes, and the verifier attested what it was shown. A single verifier gave that false data a direct path to the funds. The question to ask: how many independent checks stand between a forged message and your money, and whether one of them failing is enough.

Upgrades and admin keys: the change that breaks it

Bridges are upgradeable software, and an upgrade is a moment of risk. Nomad's fatal bug arrived in its upgrade of 21 June 2022. Liquid's attacker used a flaw created by a fix, deployed in August 2026, for an earlier bug. DefiLlama classifies Ronin's August 2024 incident as an uninitialised proxy, and Ronin said on X on 6 August 2024 that the upgrade deployed that day had made the bridge misread its operators' vote threshold. Wormhole's report adds a different risk: a change that happened to fix its flaw sat in a public repository for about three weeks, awaiting audit, and the attacker may have noticed it there.

Whoever can upgrade a bridge can also change what it accepts, so the upgrade key is a signing key under another name. A bridge that can be changed instantly by a small group carries that group's key risk on top of everything else. The question to ask: who can change the contracts, how quickly, and whether the version actually deployed was reviewed. For rollups, how much power a security council holds, and with what delay, is covered in our guide to L2 security trade-offs.

Economic failure: the loss lands elsewhere

The last class concerns where the damage ends up. A drained bridge leaves wrapped tokens without backing, and anyone who accepted those tokens as payment, liquidity or collateral inherits the shortfall. Ronin's June 2022 update shows a version of this inside one ecosystem: after users were repaid, it said the Axie DAO treasury's 56,000 ether would remain undercollateralised.

Lending markets are the sharpest case. Aave's governance forum report of 20 April 2026 warned that the rsETH price feed could keep quoting the pre-exploit rate for a period unless Aave's own feed was updated independently. A lending market can therefore go on valuing a bridged token as if its backing were intact, and lend real assets against it, after the backing has gone. The question to ask: what backs the token you hold, and who else lends against it.

What the fixes have in common

The changes operators made afterwards point the same way. Ronin raised its threshold from five of nine signatures to eight, then added withdrawal limits when the bridge reopened (29 March and 28 June 2022). Harmony moved the Ethereum side of its bridge to a 4-of-5 multisig (Harmony, 25 June 2022). LayerZero Labs says its verifier will no longer act as the only required attestor on any channel (20 May 2026). Blockstream says the most structurally robust fix will now be the default for consensus-critical bugs, that critical fixes will be reviewed by an independent auditor before release, and that critical consensus code will undergo recurring review even when it has not recently changed (23 September 2026). Liquid's original caching bug had sat in the code since 2018.

• More independent signers or verifiers, and more of them required to agree.
• Limits and delays on large withdrawals, so that one failure cannot empty the vault at once.
• Independent review of fixes and upgrades before they reach production, including code that has not changed for years.

Each of those changes came after a loss. When you assess a bridge, look for them before one.

Rules That Cut Your Exposure

The four classes translate into a short list of habits. None of them makes a bridge safe. Each one limits how much of your money depends on a single bridge's signers, verification code or upgrade keys, and they work best in the order below.

Skip the bridge when an exchange can do it

If your funds start on an exchange, the simplest route is often to withdraw directly to the network you need, provided the exchange supports that network for that asset. You then avoid a bridge's signers and contracts for the transfer itself, although the token you receive can still be a bridged version where that is the only form of the asset on that network. The trade is the exchange's custody risk while the money sits there, so this suits a transfer rather than storage. Before you send, check that the network shown in the withdrawal form matches the one your receiving wallet uses, and send a small test amount first if you have not used the route before.

Prefer native issuance to wrapped tokens

Several of the losses above emptied a pool of locked tokens that backed a wrapped version elsewhere. Where an issuer mints its own token on each network, there is no such pool to drain. For USDC, Circle's Cross-Chain Transfer Protocol (CCTP) burns the token on the source chain and mints it natively on the destination, without traditional bridge liquidity pools, according to Circle's developer documentation read on 19 October 2026. Our guide to moving stablecoins between chains covers CCTP step by step.

That does not remove trust; it moves it. The same documentation names an attestation service, Iris, in the CCTP flow, so you rely on Circle's infrastructure rather than on a bridge's signers. For a stablecoin you already trust Circle to redeem, that is usually a smaller added assumption than a new set of bridge validators. Native issuance cannot help with an asset that exists on the destination only in wrapped form; for those, the next two rules apply.

Use a rollup's own bridge when you can wait

Between Ethereum and a rollup that settles withdrawals through a dispute window, as Base does, the rollup's own bridge relies on the rollup's proof system, and a withdrawal to Ethereum waits out a period in which an invalid claim can be disputed. The cost is time. Base's documentation, read on 19 October 2026, gives that window as 5 days, or 1 day only when both a TEE proof and a ZK proof back the same proposal, and our comparison of Arbitrum, Optimism and Base sets out how the three differ.

Base's page adds a point worth remembering whichever rollup you use: third-party bridges that release funds faster use their own liquidity and do not change the window. Speed comes from a different trust arrangement. Why some rollups make you wait and others can prove a withdrawal sooner is explained in our comparison of optimistic and ZK rollups, and our guide to L2 fees and bridging covers what a first transfer costs.

Ask who verifies and who can upgrade

Before you use any other bridge, look in its own documentation for three answers:

• Who confirms that a transfer happened on the other chain: a group of signers, a single verifier, or a proof checked by code.
• How many of them must agree, and whether they are run by organisations independent of each other.
• Who can change the contracts, and whether there is a delay before an upgrade takes effect.

The record shows why each answer matters. Ronin's five-of-nine threshold rested on one company's four keys (Ronin, 29 March 2022). Kelp's route rested on one verifier (LayerZero Labs, 20 May 2026). Nomad's fatal change arrived in an upgrade (Nomad, 5 August 2022).

If the documentation does not answer those questions, treat that as the answer. Also look for safeguards that limit damage after a failure, such as withdrawal limits or delays on large transfers. Ronin's June 2022 update, for example, described a circuit breaker that required more signatures, a human review and a seven-day review for withdrawals of $10 million or more.

Move what you need, and do not park it

A bridge failure hurts two groups: people whose transfer is in flight, and everyone holding the wrapped token afterwards. You can limit both. Move the amount you need for the task rather than your whole balance, and split a large transfer so that one failure cannot take all of it.

Once you arrive, swap a wrapped token for the native version if one exists on that network, rather than holding the wrapped version for months. The Liquid case shows why: once the unbacked LBTC had been accepted, Blockstream says, no node could tell it from the genuine token. The longer you hold a wrapped asset, the longer your balance depends on the bridge behind it.

Treat bridged tokens as weaker collateral

If you borrow against a bridged or wrapped token, or lend into a market that accepts one, its value depends on the bridge as well as on the asset. The Kelp incident showed how the damage travels: the unbacked rsETH became collateral, and a lending market's price feed could go on valuing it at the pre-exploit rate for a time. Keep borrowing well below the limit when the collateral is bridged, know which bridge stands behind it, and be wary of markets that accept wrapped tokens from bridges you would not use yourself. Our guide to DeFi lending security covers collateral risk in more depth.

Reach the bridge from an address you trust

Not every bridge loss is a hack of the bridge itself. DefiLlama's database, read on 19 October 2026, also records an impersonation scam it lists as Fake GIWA Bridge, at $2.1 million on 27 September 2026, and a DNS hijack of Celer's cBridge front end on 18 August 2022, at $240,000. Type the bridge's address yourself or use a bookmark you saved, and read what your wallet asks you to sign before you approve it. How to check a site, and what a drainer's signature request looks like, are covered in our crypto scam protection guide.

Clear approvals you no longer need

Using a bridge often means giving its contract permission to move a token from your wallet, and that permission can outlive the transfer. DefiLlama classifies a loss at LI.FI on 16 July 2024, listed as LiFi Finance, as token approval abuse. Review the token approvals your wallet has granted from time to time, and revoke those you no longer use, unlimited ones first. Our guide to signing and revoking approvals shows how.

After You Arrive: Custody

A bridge transfer takes minutes or days; custody is the rest of the time. A hardware wallet cannot protect funds that sit inside a bridge contract, or a wrapped token whose backing has gone. That risk belongs to the bridge. What it protects is the part you control: the private keys that approve your bridge transactions and that hold your assets afterwards.

That matters because key theft runs through the record, and it applies to individuals as much as to bridge operators. Two devices take different approaches to keeping keys away from an internet-connected computer or phone:

• Ledger hardware wallets (review): Ledger says its wallets store private keys in a secure, offline environment and are powered by a Secure Element chip (ledger.com, read 19 October 2026), and its support centre says that on 5 January 2026 Global-e, which handles purchases on Ledger.com, notified affected customers that an unauthorised party had accessed order data such as names, postal and email addresses and phone numbers, but no payment information, and that Ledger's own systems and products were not involved (last updated 14 May 2026). Ledger said on 15 October 2026 that genuine devices fitted with hidden parts to capture recovery phrases had been resold through resellers in South East Asia.
• Tangem card wallets (review): Tangem says its private keys are generated on the card, stay on the card and are used on the card for signing, inside a certified secure element (tangem.com, read 19 October 2026).
• Whichever you use, approve bridge transactions only after reading what you are signing, and keep long-term holdings on the device rather than in the wallet you use for bridging.

A device is only as safe as its backup. Keep the backup offline and away from the computer you bridge from; our guide to seed phrase backup and recovery covers the options.

If a Bridge You Used Is Exploited

When a bridge you used is exploited, the first decisions are the ones most easily rushed. A few steps keep you from adding to the loss:

• Pause. Stop using the bridge until the project explains what happened, and follow its updates from an address you reach yourself, not from a link in a message.
• Ignore recovery offers. Anyone who offers to recover your funds for a fee should be treated as a scammer, however official they sound.
• Revoke approvals. Remove the token approvals you gave the bridge's contracts, so that a compromised contract cannot reach what is still in your wallet.
• Check the backing. If you hold the bridge's wrapped token, find out what still backs it before you sell or move it, since thin markets during an incident can turn a temporary gap into a realised loss.
• Keep records. Save your transactions and balances, in case a claims or reimbursement process opens later.

Outcomes in the record varied widely. In the incidents' own accounts, Wormhole's backer refilled its contract within about a day (Wormhole, 4 February 2022), Ronin's users were made whole three months after the attack (Ronin, 28 June 2022), Poly Network's assets were returned within 15 days (Poly Network, September 2021), and Harmony was still preparing options for a community vote three weeks after its loss (Harmony, 14 July 2022). After Multichain's losses, the Fantom Foundation turned to the courts. None of those outcomes could have been predicted on the day.

Conclusion

Bridges get drained because they concentrate value behind a single decision: whether a message from another chain is true. The record on this page shows that decision failing in four ways. Signers' keys were stolen at Ronin and Harmony. Verification was bypassed, fooled or fed false data at Poly Network, Wormhole, Nomad, BNB Chain's Token Hub, Kelp and Liquid. Upgrades brought flaws in at Nomad and Liquid. And unbacked tokens carried the damage into other markets, most visibly when Kelp's rsETH reached Aave.

The same record shows how little the size of a bridge, its audits or its number of validators settled on their own. Ronin had nine validators and one company held four keys (Ronin, 29 March 2022). Wormhole had 19 guardians and a single unchecked account bypassed them (Wormhole, 4 February 2022). Liquid had a federation of 15 functionaries and a caching flaw introduced by a security fix (Blockstream, 23 September 2026). What mattered each time was independence, redundancy and the path a forged message could take to the money.

For your own transfers, the order of the rules is the point. Avoid a bridge when an exchange can withdraw directly to the network you need. Prefer native issuance to wrapped tokens. Use a rollup's own bridge when you can wait. For anything else, find out who verifies, how many must agree and who can upgrade, and treat silence as an answer. Move only what you need, swap wrapped tokens for native ones once you arrive, and reach every bridge from an address you trust.

Then hold what you keep for the long term in native assets where you can, and in custody you control. A hardware wallet does not undo a bridge hack, but it keeps your private keys off the computer or phone you bridge from, which makes them much harder for an attacker to take. If a bridge you used is exploited, slow down, revoke its approvals and plan as if the loss is permanent until the project shows otherwise.

Sources

Every source below was read on 19 October 2026, except the Aave pool data, read on 13 October 2026 for our Aave page, and Ledger's post of 15 October 2026, read on 20 October 2026. Each entry names the document, its date and what it supports on this page. Four documents published on Medium were read through archived copies because the site refuses automated readers; the links point to the originals.

• DefiLlama, hacks database (public API), last modified 19 October 2026 — the dollar size, date and classification of each incident, the trailing 12-month bridge share in the lead, the yearly and whole-database shares, the five largest records overall, the records named in the rules section and the counts of bridge-flagged records. api.llama.fi
• Poly Network, Honour, Exploit, and Code: How We Lost 610M Dollar and Got It Back, September 2021 — the amount stolen, the attacker's announcement and the return of the assets within 15 days. medium.com
• Wormhole, Wormhole Incident Report 02/02/22, 4 February 2022 — the 120,000 unbacked wrapped ether, the 93,750 sent to Ethereum, the signature-check flaw, the recapitalisation, the 16-hour duration, the 19 guardians and the unreleased fix. medium.com
• Ronin, Community Alert: Ronin Validators Compromised, 29 March 2022, updated until 28 June 2022, originally published at roninblockchain.substack.com/p/community-alert-ronin-validators and archived on 1 April 2023; the original address now returns 404 and the post is not in Ronin's current blog archive — the amounts drained, the five-of-nine threshold, the Axie DAO access, the discovery, the new threshold, the root cause and the FBI attribution. web.archive.org
• Ronin, The Ronin Bridge Is Open, 28 June 2022 — users made whole, the Sky Mavis reimbursement, the Axie DAO treasury shortfall and the circuit breaker. roninchain.com
• Ronin, posts on X, 6 August 2024 — the bridge upgrade that misread its operators' vote threshold and the withdrawal limit that capped the amount taken, then, in two later posts that day, the return of the funds. twitter.com
• Harmony, Harmony's Horizon Bridge Hack, 24 June 2022, updated until 14 July 2022 — the compromised keys and how they were stored, the 4-of-5 multisig and the options for affected wallets. medium.com
• Nomad, Nomad Bridge Hack: Root Cause Analysis, 5 August 2022 — the forged messages, the upgrade of 21 June 2022, the change made during the audit and why the watchers did not react. medium.com
• BNB Chain, BNB Chain Ecosystem Update, 7 October 2022 — BSC Token Hub, the forged proof, the 2 million BNB, the validators contacted one by one and the funds under control. bnbchain.org
• Fantom Foundation, Fantom Foundation Awarded Default Judgement Against Multichain, 4 March 2024 — the July 2023 losses across chains, the Multichain team's absence, the investigation in Kunming and the Singapore default judgment. fantom.foundation
• LayerZero Labs, LayerZero Labs KelpDAO Incident Report, 20 May 2026 — the 116,500 rsETH, the breach from 6 March 2026, the poisoned RPC nodes and the denial-of-service attack, the single-verifier configuration, the attribution and the change to its verifier. layerzero.network
• Aave governance forum, rsETH Incident Report (April 20, 2026), co-authored by Aave service providers — the lock-and-mint design, the 1-of-1 route, the adapter balance, the collateral supplied on Aave and the price-feed warning. governance.aave.com
• Aave V3 pool data, read through Etherscan's contract reader on 13 October 2026 for our Aave page — the roughly 84,000 ETH of bad debt the Kelp incident left on Aave. etherscan.io
• Blockstream, Liquid Network Security Incident Assessment, 23 September 2026, as republished on Liquid's blog with its current status notice — the caching flaw, the 4,000 unbacked LBTC, the SideSwap peg-out, the reserve, the fix that introduced the flaw, the 3,400 bitcoin returned and the 602 outstanding. liquid.net
• Circle, Cross-Chain Transfer Protocol developer documentation — burn-and-mint transfers of native USDC without bridge liquidity pools, and the attestation service. developers.circle.com
• Base documentation, Transaction finality — the 5-day and 1-day withdrawal windows and third-party bridges' own liquidity. docs.base.org
• Ledger, ledger.com home page — private keys in a secure, offline environment and the Secure Element chip. ledger.com
• Ledger support, Global-e Incident to Order Data - January 2026, last updated 14 May 2026 — the Global-e notification of 5 January 2026 about accessed order data, with no payment information, and Ledger's statement that its own systems and products were not involved. support.ledger.com
• Ledger, Ledger's Response to the Hardware Implant Attack, 15 October 2026 — genuine devices fitted with hidden components to capture the recovery phrase during setup and put back into distribution through resellers in South East Asia, and Ledger's statement that its systems were not compromised. ledger.com
• Tangem, Security — keys generated, stored and used on the card's certified secure element. tangem.com

Frequently Asked Questions

Can bridged funds be recovered?

Sometimes, but nothing in a bridge's design makes it likely, so plan as if a loss is permanent. In the record on this page, money came back in three ways. The attacker returned it: Poly Network said in September 2021 that the assets taken on 10 August had been returned within 15 days. A backer or the operator covered it: Wormhole said on 4 February 2022 that Jump Crypto had recapitalised its contract, and Ronin said on 28 June 2022 that all of its users had been made whole. Or part of it was handed back: Blockstream said on 23 September 2026 that 3,400 of the bitcoin taken from Liquid had been returned and that about 602 were still outstanding. Harmony was still preparing options for a community vote on 14 July 2022.

What is a bridge hack?

It is a theft from the contracts or signers that move tokens between blockchains. Most bridges in the record lock assets on one chain and mint a wrapped version on another, so an attacker who makes the bridge accept a false instruction can release the locked assets or mint tokens with nothing behind them. The incidents on this page fall into four classes: stolen signing keys, verification bugs, faulty upgrades, and economic damage that spreads to wherever the unbacked tokens are used.

Which bridge hack was the largest?

In DefiLlama's hacks database, read on 19 October 2026, the largest bridge-flagged loss is the Ronin bridge's of 23 March 2022, at $624.0 million. Poly Network's loss of 10 August 2021, at $611.0 million, and the BNB Chain bridge exploit of 6 October 2022, at $570.0 million, come next. The size of a hack and the amount finally lost can differ, as Poly Network's case shows.

Why do bridges get hacked so often?

A bridge concentrates value: the assets backing every wrapped token it has issued sit in one place, and one accepted message can release them. The attacker does not need to break the blockchains on either side, only whatever decides that a transfer happened, whether that is a small group of signers, a verifier fed false data or a piece of proof-checking code. In DefiLlama's database, read on 19 October 2026, two incidents, the Liquid Network and Kelp's rsETH bridge, carry most of the bridge losses of the past 12 months.

Is a bridge with more validators always safer?

Not on its own. Ronin had nine validators, but one company ran four of them and an old arrangement handed the attacker the fifth signature it needed (Ronin, 29 March 2022). Wormhole's 19 guardians were bypassed by a flaw in the code that checked their signatures (Wormhole, 4 February 2022), and Liquid's federation nodes accepted a transaction that a caching flaw had let through (Blockstream, 23 September 2026). How independent the signers are, how many must agree and whether one bug can bypass them all matter more than the headcount.

Is a rollup's own bridge safer than a third-party bridge?

It removes a layer of outside trust: according to Base's documentation, read on 19 October 2026, a withdrawal from Base to Ethereum through Base's own bridge waits out a period in which an invalid claim can be disputed. The price is time. The same page adds that third-party bridges which release funds faster use their own liquidity and do not change its withdrawal window, so the speed comes from a different trust arrangement rather than from the rollup.

Does a hardware wallet protect me from a bridge hack?

Not from the bridge's own failure. Funds inside a bridge contract, and the backing behind a wrapped token, sit outside your wallet. A hardware wallet protects your private keys, which sign your approvals and control the assets you hold once you arrive, but it cannot stop you approving a malicious request. Ledger says its wallets store private keys in a secure, offline environment, and Tangem says its keys are generated on the card, stay on the card and are used there for signing (both read on 19 October 2026).

What should I do if a bridge I used is exploited?

Stop using it until the project explains what happened, and follow its updates from an address you reach yourself rather than from a link someone sends you. Ignore anyone who offers to recover your money for a fee. Revoke the token approvals you gave the bridge's contracts. If you hold its wrapped token, find out what still backs it before you sell or move it, and keep a record of your transactions in case a claims process opens.

Financial Disclaimer

This content is not financial advice. All information provided is for educational purposes only. Cryptocurrency investments carry significant investment risk, and past performance does not guarantee future results. Always do your own research and consult a qualified financial advisor before making investment decisions.