Crypto glossary
Bridge hack
A bridge hack is a theft from a cross-chain bridge, typically by stealing its signing keys or exploiting a verification bug to mint or release unbacked tokens.
Most bridges lock tokens on one chain and mint a wrapped version on another, so the locking contract ends up holding a large pool of real assets. Whoever can convince the bridge that a deposit happened, or can sign for its validators, can release or mint funds that were never deposited. That makes bridges some of the most valuable single targets in crypto.
Several of the largest hacks on record were bridges. In March 2022, attackers linked to North Korea's Lazarus Group took over five of the nine validator keys of the Ronin bridge and withdrew roughly 600 million dollars. Wormhole lost 120,000 wrapped ETH in February 2022 through a signature-verification bug, Nomad was drained in August 2022 after an upgrade let anyone replay a valid message, and Harmony's Horizon bridge fell in June 2022 when a 2-of-5 multisig was compromised.
The common lesson is that a bridge is only as secure as its verification. Small validator sets, shared operators and upgradeable contracts concentrate risk, while light-client and proof-based designs reduce it at a higher cost. Wrapped tokens can lose their backing overnight after a hack, hurting holders who never used the bridge.
Example
Attackers compromise the operators of a bridge secured by a small multisig, sign withdrawals for the locked funds and leave the wrapped tokens on the other chain without backing.