Bridges have been the most targeted part of crypto: they hold large pools of locked tokens and rely on validators, signers or complex contracts. The biggest incidents include Ronin (March 2022, about $625 million), Wormhole (February 2022, about $320 million), Nomad (August 2022, about $190 million) and Multichain (July 2023, about $126 million). As a user, you cannot audit a bridge, but you can cut your exposure with a few habits.
Key Takeaways
- Main causes: stolen validator keys, contract bugs, bad upgrades.
- Your risk: using fake sites, unlimited approvals, holding wrapped tokens of a hacked bridge.
- Habits: bookmarks, small tests, limited approvals, short exposure.
Major Bridge Hacks
| Bridge | Date | Approx. loss | Cause |
|---|---|---|---|
| Ronin | Mar 2022 | $625M | Validator keys compromised |
| Wormhole | Feb 2022 | ~$320M | Signature verification bug |
| Nomad | Aug 2022 | ~$190M | Faulty upgrade let anyone withdraw |
| Multichain | Jul 2023 | ~$126M | Unauthorized withdrawals; team lost control |
Figures are as widely reported at the time; tracking sites such as Rekt keep a running list.
Safe Bridging Checklist
- Bookmark the bridge or aggregator; never use links from DMs or ads.
- Check network and address on both sides before signing.
- Approve only what you bridge instead of unlimited approvals.
- Test with a small amount on a new route.
- Prefer native tokens on arrival over wrapped versions you do not need.
- Revoke old approvals you no longer use.
- Track the transfer using the transaction hash.
What Aggregators Change
An aggregator does not remove bridge risk, but it lets you compare routes and pick well-established bridges, and it reduces the number of sites you interact with. Bridge designs and their trust assumptions are explained in cross-chain bridges explained.
