Cross-Chain Bridges Explained 2026: How They Work, Where They Break

Introduction

A bridge is software that lets something recorded on one blockchain be acted on by another. The ethereum.org developer guide to bridges explains why this needs special machinery: blockchains exist in siloed environments, so there is no native way for one chain to trade or communicate with another (page last updated 3 April 2026). Every bridge therefore needs a way to tell the destination chain that something really happened on the source chain, and that is where the trust sits.

You may meet a bridge when you want ETH or USDC on a cheaper network such as Arbitrum or Base, or when a wallet offers to move a token to a new chain. If rollups like these are new to you, our Ethereum L2 guide explains them first. This guide explains what happens to your money while a bridge moves it, and how to keep the number of parties you rely on as small as possible. It is written for the moment before you click send, when the choice is still yours.

Four mechanisms do the moving. Lock-and-mint holds your tokens on the source chain and issues a wrapped copy on the destination. Burn-and-mint destroys the token on one chain and has its issuer create it again on the other, which is how native issuance works. Liquidity networks pay you out of a pool that already sits on the destination chain. Intent-based bridges let you state the result you want and leave a competing solver to deliver it, then repay the solver once the delivery is checked.

Each mechanism answers one question differently: who has to stay honest for your funds to arrive? Some bridges rely on a group of outside signers, some on the token's issuer, some on code that checks the source chain's own consensus, and some on a waiting period in which anyone can challenge a false claim. The canonical bridges of Arbitrum One, OP Mainnet and Base use that last model, which is why withdrawals from them take days. Knowing the model tells you what an attacker would have to break.

The incident record shows which parts have failed in practice. It is a dated table of the five largest records that DefiLlama's hacks database flags as bridge hacks, followed by the share of all hacked value that bridge-flagged records took over the latest 12 months, and a caveat about how the tagging behind that share has changed. The major incidents are covered on our companion page about bridge hacks.

Then come the two safer paths, which are the practical heart of the guide. If your coins are on an exchange, you can often withdraw them straight to the network you need and skip a bridge entirely. If you are moving USDC, you can move native USDC through Circle's Cross-Chain Transfer Protocol rather than a bridged copy that someone else issued. Neither path removes every risk, and the section says what each still asks you to trust.

The guide closes with what aggregators, intents and chain abstraction change, what to do once your funds have arrived, and answers to common questions. Every figure names its source and the date it was read, because bridge figures move week by week; where a figure could not be read from a primary source on 19 October 2026, it is not on this page. No route on this page is free of risk: the safer paths reduce the number of parties you rely on, and each section says what remains.

What a Bridge Moves: Messages and Assets

The ethereum.org developer guide describes a bridge as a transportation route between blockchains along which tokens, messages, arbitrary data and even smart contract calls can be transferred (page last updated 3 April 2026). That list matters, because the thing that crosses is always information, even when the result in your wallet is a token.

A bridge carries a message, not a coin

Nothing physically leaves one blockchain for another. What crosses is a message, a statement that something happened on the source chain, such as an address locking 1 ETH in a contract or burning 100 USDC. The destination chain acts on that message only after something it trusts has vouched for it, and that something is what separates one bridge design from another.

Some bridges carry only tokens, while others carry any message an application wants to send. The ethereum.org developer guide calls the second kind generalised message passing bridges, which can transfer assets along with messages and arbitrary data, and says liquidity networks generally do not support message passing at all (page last updated 3 April 2026).

For you, the difference is practical. A token transfer ends when the token arrives, but a message can also tell a contract on the destination chain to do something with the token on arrival. A bridge that can carry instructions can carry wrong ones, so the more a transfer does on arrival, the more you are trusting the message to be exactly what you signed.

Wrapped and native: what you hold afterwards

When a bridge locks your token on one chain and issues a token on another, what you hold on the destination is a claim on the locked original. It is worth what the bridge can redeem. The ethereum.org developer guide warns that many bridges use wrapped assets to mint versions of the original on a new chain, and that this exposes the ecosystem to systemic risk, as exploits of wrapped tokens have shown (page last updated 3 April 2026).

A native token is issued on the destination chain by the same party that issues it everywhere else. Circle's documentation says its Cross-Chain Transfer Protocol is available on blockchains where USDC is natively issued (supported blockchains page, last updated 5 October 2026). Circle's Bridged USDC Standard says that bridged forms of USDC are subject to certain risks and are not issued by Circle (stablecoin-evm repository, read 19 October 2026). How USDC itself is issued and backed is covered in our complete guide to stablecoins.

A native token and a bridged one can share a name and trade at the same price for months, so the ticker in your wallet is not enough to tell them apart. Check the token's contract address against the issuer's own list before you treat a balance as the real thing.

The parts you trust when you click send

Using a bridge puts at least three things between you and the destination: the website or app you use, the smart contracts that hold or burn your tokens, and whatever verifies the message. The ethereum.org developer guide lists the risks that follow: smart contract risk, where one flaw can expose the assets, systemic risk from wrapped tokens, and counterparty risk in trusted designs, where users must assume that validators will not collude to steal their funds (page last updated 3 April 2026).

The website is the part people forget. A copy of a bridge's site can look identical and still ask you to approve a contract that empties your wallet. DefiLlama's hacks database includes an impersonation scam among its bridge-flagged records, listed as the Fake GIWA Bridge, which it records as taking $2.08 million on 27 September 2026 (database read 19 October 2026). How drainer sites work, and how to check a site before you connect, is covered in our guide to wallet drainers and phishing; it is not repeated here.

The Four Mechanisms That Move Tokens Between Chains

The ethereum.org developer guide names three ways a bridge can move an asset: lock and mint, burn and mint, and atomic swaps with another party (page last updated 3 April 2026). Liquidity networks are built on the third. A newer design, the intent-based bridge, has a draft standard of its own. The figure sets the four side by side, with what you hold at the end of each.

Lock-and-mint

Lock-and-mint produces a wrapped token. Your tokens go into a contract on the source chain, and the bridge mints a matching amount of a wrapped token on the destination. Blockstream describes the Liquid Network's bitcoin peg in exactly these terms: bitcoin locked on the Bitcoin chain is matched one for one by LBTC issued on Liquid, and bitcoin is released only against a corresponding LBTC burn (Liquid Network assessment, published 23 September 2026).

The wrapped token is only as good as the locked pool behind it. If someone can mint wrapped tokens without locking anything, the pool is no longer enough to redeem every holder. Wormhole's own incident report describes exactly that for 2 February 2022: an attacker exploited a signature verification flaw to mint 120,000 Wormhole-wrapped ether on Solana that were not backed by ether on the Ethereum side of the Portal bridge (report published 4 February 2022).

Burn-and-mint and native issuance

Burn-and-mint removes the locked pool. The token is destroyed on the source chain and created again on the destination, so the supply on each chain reflects what is really there and no pile of locked tokens waits to be stolen. It works when the token's issuer controls minting on every chain, either directly or through bridges it authorises.

CCTP, Circle's Cross-Chain Transfer Protocol, is an example run by the token's own issuer. Circle describes it as a permissionless onchain utility that transfers USDC natively across blockchains using burn-and-mint, without traditional bridge liquidity pools (CCTP overview, last updated 5 October 2026). Its technical guide sets out the three steps: a contract on the source chain burns the USDC and emits a message, Circle's offchain attestation service signs the message, and the signed message is submitted on the destination chain, where USDC is minted (last updated 14 July 2026).

The trust here sits in Circle's attestation, and Circle is also the party that issues USDC in the first place, so the transfer adds no separate bridge operator to the list of parties you rely on. Circle lists two speeds: a Fast Transfer of about 8 to 20 seconds and, from Ethereum, a Standard Transfer of 15 to 19 minutes (CCTP overview, last updated 5 October 2026).

xERC20 applies the same idea to tokens whose issuers are not stablecoin companies. It is the name used for ERC-7281, a proposal posted for discussion on 7 July 2023 under which a token's issuer chooses which bridges may burn and mint its token and sets a rate limit for each one, so that a hacked bridge can mint no more than its limit (Ethereum Magicians thread, read 19 October 2026). Its pull requests to the Ethereum standards repositories were closed without being merged, the last on 18 June 2026, so xERC20 remains a proposal rather than a finalised standard (GitHub, read 19 October 2026).

Liquidity networks

A liquidity network does not move your token at all. You pay into a pool on the source chain and are paid out from a separate pool that already sits on the destination chain, so the transfer is a swap between two pools that the network keeps in balance. The ethereum.org developer guide describes these bridges as transferring assets through atomic swaps, verified by the underlying chains' own validators, and says they generally do not support message passing (page last updated 3 April 2026).

Because the payout comes from money that is already there, a liquidity network can be fast. Base's documentation makes the point for withdrawals to Ethereum: third-party bridges that release funds sooner than Base's own finalisation window use their own liquidity and do not change that window (transaction finality page, last updated 29 September 2026).

The cost is that you depend on the pool. A thin pool means a worse rate, a lower maximum or slippage on a large transfer, and the ethereum.org developer guide notes that bridges charge fixed or variable fees that depend on gas costs and on the liquidity of specific routes (page last updated 3 April 2026). The pool's contracts also hold other people's money, which makes them a target in their own right.

Intent-based bridges and solvers

An intent is an order that states the outcome you want rather than the steps to reach it. The draft standard ERC-7683, created on 11 April 2024, defines an order as an offer of payment in exchange for meeting a set of requirements, and describes intent protocols in which specialised actors called solvers, also known as fillers, carry out the required actions and receive payment (ERC-7683, read 19 October 2026).

For a bridge, that means your tokens wait in a contract with an order such as a request for 1,000 USDC on Base, a solver pays you from its own funds on the destination chain, and the protocol repays the solver once the delivery has been checked. Chainlink's explainer on chain abstraction notes that solvers often take on the waiting themselves, giving the user an early result while they wait for settlement onchain (last updated 26 March 2026).

deBridge is one intent-based design. Its documentation describes a non-custodial execution layer in which competitive solvers provide liquidity on demand, with no shared liquidity pools; your tokens are deposited into a source-chain contract for each order, the order is filled on the destination chain, and an order that is not filled can be cancelled with the tokens reclaimed in full, fees included (deBridge documentation, read 19 October 2026).

An intent moves the risk rather than removing it. You still rely on the escrow contract that holds your order and on the rules that decide when a solver has delivered.

Trust Models: Who Has to Stay Honest

The ethereum.org developer guide sorts bridges into two groups. Trusted bridges are verified externally, by a federation using a multisig, a multi-party computation system or an oracle network, while trustless bridges rely on the blockchains they connect and on those chains' own validators (page last updated 3 April 2026). The same guide says bridges secured by external validators are typically less secure than bridges secured locally or natively by the blockchain's validators. Most bridges you will meet sit between the two extremes, in one of four common models.

External validator sets

The simplest model is a group of signers. A message counts as true once enough of them sign it, so the security is the number of signers an attacker would need and how independent those signers really are.

Wormhole's documentation says its network relies on 19 nodes called guardians, that on some chains only a delegated subset of them observes the source chain, and that every message is still produced as a 13-of-19 multisignature attestation (guardian documentation, last updated 28 September 2026). A threshold like that works the same way as the M-of-N wallets in our guide to multisig wallets, only with the signers spread across companies rather than devices. Wormhole's own incident report of 4 February 2022 added that the guardians also govern the network, so that upgrades to its protocol and contracts needed a supermajority of more than two-thirds of them.

Chainlink's architecture overview says every CCIP 2.0 lane verifies messages by default with a committee of 16 independent node operators, and that a lane can require further independent verifiers (last updated 16 October 2026). The same page describes an emergency switch: when a chain or lane is cursed through CCIP's RMN contract, sends and executions involving it revert until the curse is lifted.

LayerZero lets each application choose its own set of verifiers, called DVNs, and its own threshold for each route (security stack documentation, read 19 October 2026). The same page says three of its four preset default configurations list LayerZero Labs as a required verifier, and tells production applications to set at least one required verifier that LayerZero Labs does not operate. For you, the security of a LayerZero-based token therefore depends on how its issuer configured it, not on the protocol's name. Our guide to L2 security trade-offs includes the April 2026 Kelp incident among its case studies.

Federations follow the same logic with fewer, named members. Blockstream's assessment of the Liquid Network says the sidechain is run by 15 functionary nodes and that blocks need signatures from at least 11 of them (published 23 September 2026). The same assessment traces the 2026 Liquid loss to two issues: a flaw in the verification code that Liquid's nodes ran, which led them, functionary nodes included, to accept a transaction whose output was not backed by its inputs, and a gap in how one federation member's peg-out signing was configured.

Light clients and zero-knowledge proofs

A light-client bridge removes the outside signers. Code on the destination chain checks the source chain's own consensus, so a forged message would have to fool the source chain's rules rather than a committee. The ethereum.org developer guide counts bridges that rely on the connected chains and their validators as trustless, because they add no new trust assumptions, and notes that light-client bridges pay for this in connectivity (page last updated 3 April 2026).

Zero-knowledge proofs are the other route away from outside signers. Wormhole's own documentation says its guardian network can evolve into a fully trustless system once zero-knowledge proofs become widely viable (read 19 October 2026). Proofs already appear in rollup withdrawals: Base's documentation says the state claims its withdrawals rely on are submitted to Ethereum with a TEE proof or a ZK proof, and can be disputed with a ZK proof (transaction finality page, last updated 29 September 2026).

Optimistic verification

Optimistic designs accept a claim unless someone proves it false within a set period. They rely on someone watching and disputing a false claim in time, and you wait for the period to pass. The ethereum.org developer guide names that speed drawback for optimistic bridges that use fraud proofs (page last updated 3 April 2026).

Arbitrum's troubleshooting guide says that a validator includes a withdrawal from Arbitrum One or Nova in an assertion posted to Ethereum, usually within the hour, that the assertion becomes confirmable once a dispute window of about a week has passed, and that anybody can then confirm it on Ethereum (read 19 October 2026). The window exists so that a false assertion can be disputed before it counts. The waiting period is the security, so a bridge that pays you before it ends is fronting its own money for your transfer rather than relying on the window.

Canonical rollup bridges and the withdrawal window

Every Ethereum rollup has a canonical bridge, the one the rollup itself runs, and it inherits the rollup's own security model. Deposits from Ethereum are quick: Arbitrum's bridge guide expects funds to arrive within roughly 15 to 30 minutes, and Base's documentation says deposits are typically included by the Base sequencer within 3 minutes (both read 19 October 2026). Withdrawals back to Ethereum through the three canonical bridges below are slow, and how slow now differs by chain.

• Arbitrum One: Arbitrum's bridge guide says you will have to wait at least seven days and that the bridge shows a countdown of 7 to 8 days, and its troubleshooting page puts the dispute window at 45,818 blocks, about 6.4 days, and says a withdrawal cannot be cancelled once it has been initiated (both read 19 October 2026).
• OP Mainnet: a withdrawal takes three transactions, one to start it on the rollup, one to prove it on Ethereum and one to finalise it, and the OP Stack documentation puts the fault challenge period between proving and finalising at 7 days on mainnet (withdrawal flow page, read 19 October 2026).
• Base: Base has shortened its window, and its documentation says that since the Beryl upgrade the finalisation window is 5 days for a single-proof dispute game, or 1 day only when both a TEE proof and a ZK proof back the same claim (transaction finality page, last updated 29 September 2026).

The canonical bridge is the slow route, and the delay is the price of adding no outside operator. When you cannot wait, a third-party bridge or an exchange can get you to Ethereum sooner, but you then rely on that party instead. Our comparison of Arbitrum, Optimism and Base sets out the three chains' proof systems and withdrawal windows side by side, and our guide to L2 fees and bridging costs covers what each route costs.

Hyperlane and security you choose

Hyperlane is a permissionless interoperability protocol for messages and asset transfers between chains. Its documentation says anyone can deploy it to a layer 1, a rollup or an app-chain with no approvals and no intermediaries, and that its Interchain Security Modules let each application configure, compose and customise its own security model (Intro to Hyperlane, read 19 October 2026).

Permissionless deployment helps builders and leaves a question for you. Two tokens that both run on Hyperlane can be protected by very different modules, so the protocol's name tells you less than the configuration behind your particular token.

Where Bridges Break: The Incident Record

DefiLlama keeps a public database of hacks in which each record carries a flag for whether DefiLlama classes it as a bridge hack. The table takes the five largest records carrying that flag, read from the database on 19 October 2026, when it had last been updated at 06:36 GMT that day. Each row gives the date, the name the database uses, the amount it records and the technique it assigns.

The amounts are what the database records as taken, which is not always what was finally lost. Wormhole's incident report says Jump Crypto replenished the Portal contract with 120,000 ETH on 3 February 2022, restoring its collateral (report published 4 February 2022). Blockstream's assessment says the Liquid Network attacker returned 3,400 BTC on 7 September 2026, and that about 602 BTC remained outstanding when the assessment was published on 23 September 2026.

The trailing 12-month share

Over the 12 months from 19 October 2025 to 18 October 2026, records flagged as bridge hacks account for 30.9% of all value hacked in DefiLlama's database: $764.2 million of $2,470.6 million, across 51 bridge-flagged records (database read 19 October 2026).

Two incidents carry most of that. In DefiLlama's hacks database, the Liquid Network record of 6 September 2026, at $320.0 million, and the Kelp record of 18 April 2026, at $293.0 million and recorded as cross-chain message spoofing, both rank among the five largest hacks of any kind between 19 October 2025 and 18 October 2026 (read 19 October 2026).

We measure the trailing 12 months rather than a calendar year on purpose. In DefiLlama's hacks database, bridge-flagged records were 2.2% of value hacked in 2024 and 1.4% in 2025 (read 19 October 2026), so a calendar-year reading would have shown bridge losses near their lowest just before the two largest bridge losses of 2026.

Why the count of bridge incidents jumped

Read the number of records with care. DefiLlama's hacks database holds 11 bridge-flagged records dated 2025 and 47 dated 2026 to date (read 19 October 2026). Part of that rise may reflect how records are added and classified rather than how many attacks took place, and the records carry no date for when the flag was set, so the count cannot settle the question. With the dollar share also resting on two incidents, treat neither figure on its own as a trend.

What the largest losses have in common

The techniques in the table fall into a few classes: compromised validator keys, meaning the private keys that sign for a bridge, flaws in how signatures or proofs are checked, access-control mistakes and tokens minted with nothing behind them. Each class is a failure of the part that vouches for a message or holds the funds, which is why the trust model matters more than a bridge's brand or its age.

Our page on bridge hacks goes through each major incident, explains the failure classes in detail and turns them into rules for how much to move at once and where to keep it afterwards.

Two Safer Paths Before You Reach for a Bridge

Often the best way to reduce bridge risk is to avoid a bridge. Two routes let many readers do that, and both work by leaving out a party you would otherwise have to trust.

Withdraw from the exchange straight to the destination chain

If your coins are on an exchange, you can often send them directly to the network you want. Arbitrum's bridge guide lists this as one way to get funds onto Arbitrum, saying most major centralised exchanges support direct withdrawals from your exchange wallet to the Arbitrum network (quickstart, read 19 October 2026). You then sign nothing on a bridge yourself, and you approve no bridge contract to spend your tokens.

OKX is one exchange that withdraws to several networks. On 19 October 2026 OKX's withdrawal page listed Arbitrum One, Base, Optimism, Linea, zkSync Era, Starknet, Unichain and X Layer among the networks for ETH, and Arbitrum One, Base, Optimism, Polygon, Solana and Avalanche C-Chain among those for USDC, with a network fee charged on each withdrawal. Our guide to getting started on OKX covers opening an account and moving funds out, and our OKX review covers where the exchange is available, its fees and its security.

The exchange is a custodian until the coins leave it, so the protection here is not the exchange itself; it is that you skip a separate bridge. Pick the destination network your wallet expects, check the address character by character, and send a small amount first. A withdrawal sent on a network your wallet does not watch can be hard or impossible to recover.

If you are in the UK, the exchange we name for this route is Kraken: its UK company, Payward Ltd, is registered with the FCA for certain cryptoasset activities (reference number 928768, registered since 23 November 2021), and its UK withdrawal fees page, last updated 31 December 2025, lists ETH withdrawals on Arbitrum One and USDC withdrawals on Arbitrum One in two versions, native USDC and USDC.e (FCA register and Kraken support, both read 19 October 2026). Payward Ltd's register entry also says the Financial Ombudsman Service cannot consider a complaint about the firm and the Financial Services Compensation Scheme cannot consider a claim against it if it fails (FCA register, read 19 October 2026).

Move USDC natively with CCTP

If what you are moving is USDC, the second path is to move native USDC rather than a wrapped copy. CCTP, set out in the mechanisms section above, burns the USDC on one chain and has Circle mint it on the other. Circle's list of supported blockchains, last updated on 5 October 2026, includes Ethereum, Arbitrum, Base, OP Mainnet, Polygon PoS, Avalanche and Solana.

USDC.e is the usual name for the bridged version. Circle's Bridged USDC Standard says a bridged USDC token commonly carries the name Bridged USDC, followed by the third-party team's name, and the symbol USDC.e, and that bridged forms of USDC are subject to certain risks and are not issued by Circle (stablecoin-evm repository, read 19 October 2026). The same standard gives Circle the option, but not the obligation, to take ownership of a bridged USDC contract deployed under it and upgrade it to native USDC, and it cannot be applied to a contract that has already been deployed without it.

The two can sit side by side on one chain. On 19 October 2026 OKX's withdrawal page listed Polygon and Polygon (USDC.e) as separate USDC networks, so the network you pick decides which token arrives in your wallet. Our guide to moving stablecoins between chains goes through CCTP, bridged USDC and xERC20 step by step.

When you still need a bridge

Some moves have no exchange route and no native issuer. Before you use a bridge for one of them, ask four questions; the first is the one the ethereum.org developer guide puts at the head of its trade-offs for choosing a bridge, who verifies the system (page last updated 3 April 2026).

• Who verifies the transfer? A signer set, the issuer, the source chain's own consensus and a challenge window each fail in different ways, and the trust models above show how to tell them apart.
• What will you hold on arrival? The issuer's native token, or a wrapped or bridged token that is only as good as the bridge behind it for as long as you hold it.
• Can you wait? A rollup's canonical bridge adds no outside operator, and the cost is the withdrawal window set out above.
• How much are you moving at once? A small test transfer first, and a large move split over time, both limit what a single failure can cost you.

None of these questions has the same answer for every transfer, but asking them in order turns a choice between brands into a choice between risks you can name.

Aggregators, Intents and Chain Abstraction

Some apps make the choice of bridge for you. The ethereum.org developer guide describes applications that integrate a bridge or a bridge aggregator so that users do not have to leave the application to bridge (page last updated 3 April 2026). Three terms describe how this works, and each one changes where the risk sits rather than whether it exists.

What an aggregator adds to the route and the risk

A bridge aggregator compares routes across many bridges and exchanges and executes the one it picks. LI.FI describes itself as a routing and execution layer that connects applications to onchain liquidity across chains, bridges, decentralised exchanges, solvers and yield protocols through a single integration, and says it calculates routes on price, speed, gas cost and execution reliability (documentation, read 19 October 2026).

An aggregator can find a better rate, but it adds contracts of its own. The ethereum.org developer guide says bridge aggregators are exposed to smart contract and technology risks just like bridges, and that more smart contracts mean more risk (page last updated 3 April 2026).

LI.FI's own incident report shows what that can mean. LI.FI's report says that on 16 July 2024, shortly after a new contract component was deployed, an attacker drained an estimated $11.6 million from 153 wallets that had given the LI.FI contract an unlimited token approval, and that finite approvals were not affected (incident report published 18 July 2024, read 19 October 2026). Our page on bridge aggregators and intents covers how routes are chosen, how solvers are paid and when an aggregator is worth its extra contract.

Chain abstraction: the bridge you do not see

Chain abstraction is the aim of letting you use an application without knowing which chain it runs on. Chainlink's explainer defines it as a user experience framework that lets people use decentralised applications without manually managing bridges, gas tokens or network details, and says it relies on intent-based systems in which solvers handle bridging in the background (last updated 26 March 2026).

The bridge has not gone; it has moved out of sight. The same explainer names security as the most pressing challenge, because moving from direct transactions to third-party solvers widens the attack surface, and a centralised solver network or flawed intent verification could leave users open to censorship or theft (last updated 26 March 2026). When an app offers to handle the chain for you, the four questions above still apply; you are simply asking them of the app.

After You Bridge: Custody, Approvals and Records

Arrival is not the end of the risk. Three habits close the loop once your funds are on the destination chain.

• Decide where the funds will live. If you received a wrapped or bridged token, decide whether to hold it or swap it for the native asset, since a wrapped token carries the bridge's risk for as long as you hold it. For savings, a hardware wallet keeps the keys off the computer you bridged from; our Ledger page covers one maker's devices, and Ledger's support centre says that on 5 January 2026 Global-e, which handles purchases on Ledger.com, notified affected customers that an unauthorised party had accessed order data such as names, postal and email addresses and phone numbers, but no payment information, and that Ledger's own systems and products were not involved (last updated 14 May 2026). Ledger said on 15 October 2026 that genuine devices fitted with hidden parts to capture recovery phrases had been resold through resellers in South East Asia.
• Revoke the approvals you gave. Bridges and aggregators ask permission to spend your tokens, and an unlimited approval stays live after the transfer, which is how the LI.FI incident above reached only wallets with unlimited approvals. Revoke on the chain where you gave the approval, usually the source chain, and expect each revocation to cost a gas fee like any other transaction. Our guide to transaction signing hygiene shows how to list and revoke them.
• Keep the records from both chains. Save the transaction hashes on the source and destination chains, the amounts and the fees. The UK tax treatment of a bridge transfer is covered in our guide to taxable events in swaps and bridges.

None of these habits needs a new tool. Each takes a few minutes, and each removes a way for a finished transfer to cost you money later.

Conclusion

A bridge is a promise that something happened on another chain, and every design answers differently who makes that promise. Lock-and-mint leaves you a wrapped claim on a pool of locked tokens. Burn-and-mint lets the issuer destroy and recreate the token, so what you hold is the real thing. Liquidity networks pay you from a pool already waiting on the other side, and intent-based bridges let a solver deliver first and settle later.

Behind each mechanism sits a trust model. A signer set is as strong as the quorum an attacker would need. An issuer's attestation is as strong as the issuer you already rely on. A light-client or proof-based bridge leans on the source chain's own consensus, and an optimistic design leans on someone watching for false claims and on a waiting period. The canonical bridges of the large rollups show that last model in practice: as read on 19 October 2026, Arbitrum's documentation puts its dispute window at about 6.4 days, the OP Stack's documentation puts its window at 7 days on mainnet, and Base's documentation puts its window at 5 days, or 1 day only when a TEE proof and a ZK proof back the same proposal.

The incident record is the reason to care. The five largest records that DefiLlama's hacks database flags as bridge hacks run from $320.0 million to $624.0 million, and two 2026 bridge incidents rank among the five largest hacks of any kind between 19 October 2025 and 18 October 2026 (database read 19 October 2026). The failures come back to the same parts: keys, verification code, access controls and tokens minted with nothing behind them. Some of those sums were later returned or replaced, so read the table as a record of what was taken rather than of what was finally lost.

So start by asking whether you need a bridge at all. If your coins are on an exchange, a direct withdrawal to the destination network avoids a bridge contract you would otherwise approve. If you are moving USDC, a native CCTP transfer relies on Circle, which already issues the token, and spares you a bridged USDC.e that Circle does not issue. In the UK, read what the register entry of any exchange you use does and does not cover before you rely on it.

When you do need a bridge, ask who verifies the transfer, what you will hold on arrival, whether you can wait for a canonical route and how much you are moving at once. Treat aggregators, intents and chain abstraction as conveniences that move the bridge out of sight rather than out of the picture; LI.FI's July 2024 incident is a reminder that an aggregator's own contract can be the weak point.

Afterwards, move what you are not using into custody you control, revoke the approvals you no longer need and keep the records for your tax return. The companion pages go deeper on each part: bridge hacks and the post-mortems behind them, stablecoin transfers with CCTP and bridged USDC, and aggregators and intents. Come back to this page whenever a new chain or a new app asks you to move funds, and run through the same questions again before anything leaves your wallet.

Sources

Every source below was read on 19 October 2026, except Ledger's post of 15 October 2026, read on 20 October 2026. Each entry names the document, the date it shows where it shows one, and what it supports on this page. Figures about bridge losses come from the hacks database and from each incident's own report; mechanisms come from each protocol's own documentation.

• DefiLlama, hacks database API, last modified 19 October 2026 at 06:36 GMT — the five-row table, the trailing 12-month share, the calendar-year shares and counts, and the Fake GIWA Bridge record. api.llama.fi
• The ethereum.org developer documentation, Bridges, last updated 3 April 2026 — siloed chains, the ways to move assets, bridge types, trusted and trustless bridges, the light-client and optimistic trade-offs, bridge risks, aggregator risk and the trade-offs for choosing a bridge. ethereum.org
• Circle, Cross-Chain Transfer Protocol overview, last updated 5 October 2026 — what CCTP is and its transfer speeds. developers.circle.com
• Circle, CCTP technical guide, last updated 14 July 2026 — the three steps of a transfer and the attestation service. developers.circle.com
• Circle, CCTP supported blockchains and domains, last updated 5 October 2026 — the blockchains where CCTP runs. developers.circle.com
• Circle, Bridged USDC Standard, in the stablecoin-evm repository — the USDC.e name and symbol, the statement that bridged USDC is not issued by Circle, and Circle's option to upgrade a bridged contract. github.com
• Ethereum Magicians, ERC-7281: Sovereign Bridged Tokens, discussion opened 7 July 2023 — the xERC20 design and its rate limits. ethereum-magicians.org
• GitHub, ethereum/ERCs pull request 89, Add ERC: Sovereign Bridged Token, closed without merging on 18 June 2026, after the earlier pull request 7281 to ethereum/EIPs was closed without merging on 25 October 2023 — the status of xERC20. github.com
• ERC-7683: Cross Chain Intents, draft, created 11 April 2024 — what an intent, an order and a solver are. eips.ethereum.org
• The deBridge documentation, What is deBridge?, undated — solvers, the absence of shared pools and the cancellation of unfilled orders. docs.debridge.com
• Chainlink, What Is Chain Abstraction?, last updated 26 March 2026 — the definition of chain abstraction, solvers taking on the wait, and the security challenge. chain.link
• LI.FI documentation, introduction, last updated 4 March 2026 — what LI.FI is and how it chooses routes. docs.li.fi
• LI.FI, Security Incident Report 16th July, published 18 July 2024 — the July 2024 incident, its estimated size, the 153 wallets and the role of unlimited approvals. li.fi
• Wormhole documentation, Guardians, last updated 28 September 2026 — the 19 guardians, delegated guardian subsets and the 13-of-19 attestation. wormhole.com
• Wormhole, Wormhole Incident Report 02/02/22, published 4 February 2022 — the unbacked mint on Solana, the Portal bridge, the replenished contract and the guardians' role in approving upgrades. wormholecrypto.medium.com
• LayerZero documentation, Security Stack (DVNs), last updated 12 May 2026 — verifier sets chosen per application, and the warning about default configurations. docs.layerzero.network
• Chainlink CCIP documentation, architecture overview, last updated 16 October 2026 — the default committee of 16 node operators, additional verifiers and the RMN curse. docs.chain.link
• Hyperlane documentation, Intro to Hyperlane, last updated 7 September 2026 — permissionless deployment and Interchain Security Modules. docs.hyperlane.xyz
• Arbitrum documentation, Arbitrum Bridge quickstart, undated — direct exchange withdrawals to Arbitrum, deposit times, the seven-day minimum and the countdown of 7 to 8 days. docs.arbitrum.io
• Arbitrum documentation, Arbitrum Bridge troubleshooting, undated — the assertion sequence for a withdrawal, the 45,818-block dispute window, about 6.4 days, and withdrawals that cannot be cancelled. docs.arbitrum.io
• OP Stack documentation, withdrawal flow, last updated 16 September 2026 — the three withdrawal transactions and the 7-day fault challenge period on mainnet. docs.optimism.io
• Base documentation, transaction finality, last updated 29 September 2026 — the 5-day and 1-day finalisation windows, deposit times, proofs and third-party liquidity. docs.base.org
• Blockstream, Liquid Network Security Incident Assessment, published 23 September 2026 — the bitcoin peg, the functionary set, the cause of the September 2026 loss and the BTC returned and outstanding. blog.blockstream.com
• OKX, crypto withdrawal fees and networks page, updated on the day it was read — the ETH and USDC withdrawal networks, the network fee and the separate Polygon (USDC.e) network. okx.com
• FCA Financial Services Register, firm entry for Payward Ltd, reference number 928768, read in a browser — the registration, its date and what the Ombudsman and the compensation scheme cannot consider. register.fca.org.uk
• Kraken support (UK), Cryptocurrency withdrawal fees and minimums, last updated 31 December 2025 — ETH and USDC withdrawals on Arbitrum One, in native USDC and USDC.e. support.kraken.com
• Ledger support, Global-e Incident to Order Data - January 2026, last updated 14 May 2026 — the Global-e notification of 5 January 2026 about accessed order data, with no payment information, and Ledger's statement that its own systems and products were not involved. support.ledger.com
• Ledger, Ledger's Response to the Hardware Implant Attack, 15 October 2026 — genuine devices fitted with hidden components to capture the recovery phrase during setup and put back into distribution through resellers in South East Asia, and Ledger's statement that its systems were not compromised. ledger.com
• Each major bridge incident is on our page on bridge hacks and security.
• CCTP, bridged USDC and xERC20 are taught step by step in our guide to moving stablecoins between chains.
• How aggregators choose routes and how solvers are paid is on our page on bridge aggregators and intents.
• The proof systems and withdrawal windows of the three largest optimistic rollups are set side by side in our comparison of Arbitrum, Optimism and Base.
• What each bridging route costs is on our guide to L2 fees and bridging costs.
• What rollups are, and how they differ from one another, is on our Ethereum L2 guide.
• How USDC and other stablecoins are issued and backed is on our complete guide to stablecoins.
• How fake sites and drainers work, and how to check a site before you connect, is on our guide to wallet drainers and phishing.
• How to list and revoke token approvals is on our guide to transaction signing hygiene.
• The UK tax treatment of a bridge transfer is on our guide to taxable events in swaps and bridges.

Frequently Asked Questions

What is a crypto bridge?

A crypto bridge is software that lets something recorded on one blockchain be acted on by another, most often to move a token's value between chains. Blockchains exist in siloed environments with no native way to communicate, as the ethereum.org developer guide to bridges notes (page last updated 3 April 2026), so every bridge relies on something to vouch that the action really happened: a set of signers, the token's issuer, code that checks the source chain's consensus, or a waiting period in which a false claim can be challenged.

Is withdrawing from an exchange safer than using a bridge?

It removes one layer of risk. If your coins are on an exchange that supports the destination network, a direct withdrawal means you do not approve or sign anything on a bridge yourself, and Arbitrum's bridge guide says most major centralised exchanges support direct withdrawals to the Arbitrum network (read 19 October 2026). The exchange is still a custodian until the coins leave it, so check the network, the address and a small test amount before you send the rest.

Why does withdrawing from Arbitrum, OP Mainnet or Base to Ethereum take days?

Their canonical bridges wait out a window in which a false claim about the rollup's state can be challenged. As read on 19 October 2026, Arbitrum's documentation puts the dispute window at about 6.4 days and its bridge shows a countdown of 7 to 8 days, the OP Stack's fault challenge period is 7 days on mainnet, and Base's finalisation window is 5 days, or 1 day only when both a TEE proof and a ZK proof back the same claim. Third-party bridges that pay out sooner use their own liquidity and do not shorten the window.

What is CCTP?

CCTP is Circle's Cross-Chain Transfer Protocol. Circle describes it as a permissionless onchain utility that transfers USDC natively between blockchains by burning it on the source chain and minting it on the destination, without traditional bridge liquidity pools, and its offchain attestation service signs each transfer message (CCTP documentation, read 19 October 2026). Circle's CCTP overview, last updated 5 October 2026, lists a Fast Transfer of about 8 to 20 seconds and, from Ethereum, a Standard Transfer of 15 to 19 minutes.

Is USDC.e the same as USDC?

No. USDC.e is the symbol commonly used for bridged USDC, a token issued on a destination chain by a third-party team against USDC held elsewhere. Circle's Bridged USDC Standard says bridged forms of USDC are subject to certain risks and are not issued by Circle, and gives Circle the option, but not the obligation, to upgrade a bridged contract deployed under that standard to native USDC (read 19 October 2026). Check which of the two a network delivers before you withdraw or bridge to it.

What is an intent-based bridge?

An intent-based bridge lets you state the outcome you want, such as an amount of a token on another chain, and leaves solvers to deliver it. The draft standard ERC-7683 describes an order as an offer of payment in exchange for meeting a set of requirements, carried out by specialised actors called solvers, also known as fillers, who are then paid (read 19 October 2026). You still rely on the contract that holds your order and on the rules that decide when a solver has delivered.

What is xERC20?

xERC20 is the name used for ERC-7281, a proposal posted for discussion on 7 July 2023 under which a token's issuer decides which bridges may burn and mint its token and sets a rate limit for each one, so that a hacked bridge can mint no more than its limit (Ethereum Magicians thread, read 19 October 2026). Its pull requests to the Ethereum standards repositories were closed without being merged, so it remains a proposal rather than a finalised standard (GitHub, read 19 October 2026).

Why do bridges get hacked?

A bridge holds or controls a pool of other people's tokens and depends on keys and code that vouch for messages between chains, so a single flaw in either can release tokens that were never deposited. The techniques that DefiLlama's hacks database assigns to the five largest records it flags as bridge hacks are a validator key compromise, improper access control, a proof verifier bug, a signature verification flaw and an unbacked cross-chain mint (database read 19 October 2026).

Does a bridge aggregator make bridging safer?

Not on its own. An aggregator picks a route across bridges and exchanges and can find a better rate, but ethereum.org notes that bridge aggregators are exposed to smart contract and technology risks like the bridges they use (developer guide, last updated 3 April 2026). LI.FI's own incident report says an attacker drained an estimated $11.6 million on 16 July 2024 from 153 wallets that had given its contract an unlimited token approval, while finite approvals were not affected.

Can I cancel a bridge transfer once it has started?

It depends on the design. Arbitrum's troubleshooting guide says a withdrawal through its canonical bridge cannot be cancelled once it has been initiated, although you can claim the funds and deposit them again once the withdrawal period has passed (read 19 October 2026). deBridge's documentation says an order on its network that is not filled can be cancelled and the tokens reclaimed in full, fees included. For any other bridge, read its own documentation on refunds before you send.

Financial Disclaimer

This content is not financial advice. All information provided is for educational purposes only. Cryptocurrency investments carry significant investment risk, and past performance does not guarantee future results. Always do your own research and consult a qualified financial advisor before making investment decisions.