Bridging crypto can be safe, but it carries more risk than most other on-chain actions, and the honest answer is “it depends on how you do it.” Cross-chain bridges have been among the largest targets for hackers because they hold huge pools of locked value in complex code. Using a reputable, audited bridge for a routine transfer is generally fine; rushing through an unfamiliar bridge with your whole balance is not. This guide explains the real history of bridge hacks, why bridges get attacked, and the concrete steps, and safer alternatives, that protect your funds.
- Bridges are higher-risk than typical transfers because they lock large amounts of value in complex contracts.
- Major hacks are real and well-documented: Ronin (~$600M), Wormhole (~$320M) and Nomad (~$190M) are the best-known.
- You can bridge much more safely: use official bridges, send a small test transaction, and revoke approvals.
- Safer alternatives exist: a CEX transfer or natively issued assets sometimes avoid bridging entirely.
So, is bridging crypto safe?
Bridging is a normal, widely used part of crypto, millions of transfers happen without incident. But the category has a worse security record than, say, sending tokens within one chain, because a single bridge contract can hold hundreds of millions of dollars and represents a concentrated, attractive target. The practical takeaway: bridging is “safe enough” when you stick to battle-tested bridges and follow basic precautions, and risky when you don’t. Understanding the failure modes is the best protection, so let’s look at what has actually gone wrong.
A short history of major bridge hacks
These exploits are public, widely reported events. They are worth knowing not to scare you off, but because they show why the precautions later in this guide matter.
Ronin Bridge (2022) — roughly $600 million
The Ronin bridge, built for the game Axie Infinity, was drained of around $600 million in one of the largest crypto hacks ever. Attackers gained control of a majority of the validator keys that authorized withdrawals, the bridge used a small set of validators, and compromising enough of them let the attackers approve fraudulent transfers. It is a textbook example of how centralized control points become single points of failure.
Wormhole (2022) — roughly $320 million
Wormhole, a major cross-chain messaging bridge connecting Solana and other chains, was exploited for about $320 million. The attacker exploited a flaw in how the bridge verified signatures, tricking it into minting wrapped tokens that were not actually backed by deposits. The funds were later replenished by the backers, and security was hardened, but the incident showed how a single verification bug can be catastrophic.
Nomad (2022) — roughly $190 million
The Nomad bridge lost around $190 million in an unusual “free-for-all” exploit: a flawed contract upgrade made it possible for almost anyone to copy a working malicious transaction and drain funds. Once the method was visible on-chain, crowds of copycats piled in. It illustrated how a single configuration mistake can turn into a chaotic, mass-participation drain.
Why are bridges targeted so often?
Several structural factors make bridges unusually risky:
- Concentrated value: bridges lock large reserves to back assets on the other side, a honeypot for attackers.
- Complex code: connecting two chains with different rules requires intricate logic, and complexity breeds bugs.
- Trusted validators or keys: many bridges rely on a set of signers; compromise enough of them and the funds are gone (as in Ronin).
- Cross-chain verification is hard: proving an event on one chain to another is genuinely difficult, and verification flaws (as in Wormhole) are devastating.
- Fast-moving upgrades: a single bad deployment can open a hole instantly (as in Nomad).
For broader context on the ecosystem these bridges connect, our overview of what DeFi is explains the composable, interconnected design that makes cross-chain transfers necessary in the first place.
How to bridge crypto safely
You cannot remove all risk, but you can dramatically reduce it with disciplined habits.
1. Use official or battle-tested bridges
For moving funds onto a Layer 2, prefer the network’s official (“canonical”) bridge, it adds the fewest extra trust assumptions. For other routes, choose bridges with long track records, audits, and large, long-lived value rather than brand-new ones chasing incentives. Our step-by-step guide on how to bridge crypto walks through the process safely.
2. Always send a small test transaction
Before moving a large amount, bridge a tiny sum first and confirm it arrives on the destination chain in the correct token. This catches wrong-chain mistakes, address errors, and front-end problems before they become expensive. It costs a little extra gas, cheap insurance.
3. Verify the URL and the destination
Phishing sites that impersonate bridges are common. Reach the bridge through a bookmark or an official link, never an ad or a random search result, and double-check the destination chain and token. Confirm you are connected with the right wallet; see how to use MetaMask for safe connection habits.
4. Revoke token approvals you don’t need
Bridges and DEXs ask you to “approve” tokens for spending. Leaving unlimited approvals active is a standing risk if that contract is ever exploited. Periodically review and revoke approvals you no longer use with a reputable approval-checker tool.
5. Protect your seed phrase above all
No bridge precaution helps if your wallet itself is compromised. Never enter your recovery phrase into any website, including ones claiming to “fix” a stuck bridge transfer. Our explainer on what a seed phrase is covers why it must stay offline and private, forever.
How to judge whether a specific bridge is trustworthy
Not all bridges carry equal risk, so it helps to have a quick mental checklist before you use one. None of these guarantees safety, but together they separate battle-tested infrastructure from risky newcomers:
- Audits and track record: has the bridge been independently audited, and has it operated for a meaningful length of time without a major incident? Longevity under real value is the strongest signal.
- Decentralization of control: how many parties must be compromised to authorize a withdrawal? The Ronin hack happened because too few validators held too much power. More distributed designs raise the bar for attackers.
- Transparency: can you see how the bridge verifies cross-chain events, and is its code open and reviewed? Opaque systems are harder to trust.
- Value at stake: a bridge holding very large reserves is both a sign of trust and a bigger target, weigh both.
- Response history: if it has been exploited before, how did the team respond? Some, like Wormhole, restored funds and hardened their systems, which is informative.
When in doubt, default to an official Layer 2 bridge for deposits, or an established, widely used route for everything else, rather than an unfamiliar bridge promising the lowest fee.
What happens to your money during a bridge transfer
Understanding the in-between state explains a lot of the risk. With a lock-and-mint bridge, your asset is locked in a contract on the source chain while a representation is minted on the destination, the locked reserve is what attackers go after. With a liquidity-pool bridge, you are paid from a pool on the destination chain, so the risk shifts to those pools and the relayers that manage them. In both cases there is a brief window where your funds depend entirely on the bridge’s code and operators behaving correctly. That window is why a test transaction and a reputable bridge matter so much: you are temporarily trusting infrastructure, not just your own wallet.
Safer alternatives to bridging
Sometimes the safest bridge is no bridge at all. Consider these options:
- Use a centralized exchange (CEX) as the “bridge”: deposit an asset from chain A, then withdraw it on chain B if the exchange supports both networks. You take on exchange custody risk briefly, but you avoid bridge-contract risk entirely.
- Prefer natively issued assets: some assets (for example, certain stablecoins) are issued natively on multiple chains, so you can acquire the native version on the destination chain instead of bridging a wrapped one.
- Buy directly on the destination chain: if you just want exposure on chain B, sometimes it’s simpler and safer to buy there rather than bridge.
None of these is universally better, each has its own trade-offs, but they widen your options when a bridge feels risky for a large transfer.
Bottom line
Bridging crypto is reasonably safe when you use reputable, audited bridges and follow basic discipline, official routes, a test transaction, URL verification, approval hygiene, and ironclad seed-phrase security. The famous hacks happened to specific, often centralized or buggy designs, not to every bridge equally. Match the method to the amount: a small transfer through a trusted bridge is routine, while a large one deserves extra caution and possibly a CEX route instead.
FAQ
Is bridging crypto safe for beginners?
It can be, if you start small and stick to reputable bridges. The biggest beginner mistakes are using an unfamiliar or unaudited bridge, falling for a phishing site, and skipping a test transaction. Begin with a tiny amount on a well-known route, confirm it arrives, and only then move larger sums once you are comfortable with the process.
What was the biggest bridge hack?
The Ronin bridge hack in 2022 is among the largest, with roughly $600 million stolen after attackers compromised a majority of the bridge’s validator keys. Other major incidents include Wormhole (about $320 million, via a signature-verification flaw) and Nomad (about $190 million, from a faulty contract upgrade). All three are well-documented public events.
Can I avoid bridges entirely?
Often, yes. If a centralized exchange supports both the source and destination networks, you can deposit on one chain and withdraw on the other, using the exchange as a bridge. You can also buy the asset natively on the destination chain or use assets issued natively across multiple chains. Each approach has its own trade-offs to weigh.
What should I do if a bridge transaction gets stuck?
First, wait, cross-chain transfers can take minutes or, for some L2 withdrawals, up to about seven days. Check the bridge’s transaction explorer and status page. Never enter your seed phrase into any “support” site or DM offering to recover a stuck transfer; those are scams. Use only the bridge’s official support channels for help.
Crypto is volatile and risky; this is education, not financial advice. Do your own research.
