A bridge is a protocol that moves assets or data between two separate blockchains. You lock tokens on Chain A, and the bridge mints equivalent tokens on Chain B. When you want to go back, you burn on Chain B and unlock on Chain A. Bridges are the most attacked piece of crypto infrastructure because they hold concentrated pools of locked assets and connect systems with fundamentally different security models.
What Is a Bridge (Cross-Chain, Mechanics and Structural Risk)?
3 min read
The short version
A bridge is like a currency exchange booth between two countries that operate on different monetary systems. You hand over your euros on one side, and receive equivalent yen on the other. The exchange booth must hold both currencies in reserve. If someone robs the booth (hacks the bridge), everyone who deposited money loses it. This is why bridges are the single biggest target for attackers in crypto.
How It Works
Bridge types: (1) Lock-and-mint (most common): you lock ETH on Ethereum, the bridge mints "wrapped ETH" on the destination chain. Trust assumption: the bridge validators/contracts correctly track what is locked and minted. (2) Liquidity networks (Across, Stargate): instead of locking/minting, relayers front you funds on the destination using their own liquidity, then claim from the source later. Faster, no wrapped tokens, but limited by available liquidity. (3) Native bridges (rollup bridges): L2 rollups have canonical bridges backed by the L1 contracts themselves. These inherit L1 security and are the safest but slowest (7 days for optimistic rollups). Attack history: over $2.5 billion stolen from bridges since 2021. Ronin ($625M), Wormhole ($320M), Nomad ($190M), Harmony ($100M). Bridges concentrate value in a single contract and require complex multi-chain coordination, creating ideal attack targets.
Bridging USDC from Ethereum to Arbitrum using the official bridge
You want to move 5,000 USDC from Ethereum to Arbitrum. Using the official Arbitrum bridge (bridge.arbitrum.io): (1) You approve the bridge contract to spend your USDC. (2) You deposit 5,000 USDC into the L1 bridge contract. It locks your USDC on Ethereum. (3) Within ~10 minutes, Arbitrum's L2 recognizes the L1 deposit event. (4) 5,000 USDC appears in your same address on Arbitrum (bridged version, backed 1:1 by the locked L1 USDC). Cost: one L1 transaction (~$5-$15 in gas). Speed: ~10 minutes. Security: backed by Ethereum itself (the bridge is part of Arbitrum's rollup contracts, not a third-party bridge). Going back: 7-day challenge period for native withdrawal, or use Across/Stargate for a fast bridge (~2 minutes, small fee).
What People Get Wrong
All bridges are equally secure
Security ranges enormously. Native rollup bridges (Arbitrum, Optimism official bridges) inherit Ethereum security. Third-party bridges (Multichain, Wormhole) depend on their own validator sets. A bridge validated by 5 people is far less secure than one validated by 900,000 Ethereum validators. Check L2Beat.com for bridge security assessments.
Bridged tokens are the same as native tokens
Bridged (wrapped) tokens are IOUs backed by locked assets on the source chain. If the bridge is hacked and reserves are drained, bridged tokens become worthless even though they still exist in your wallet. USDC on Arbitrum via the native bridge is as safe as the bridge itself. USDC on an obscure chain via a third-party bridge carries that bridge's risk.
Using a bridge is risk-free if you withdraw quickly
The risk is during the time your assets are on the destination chain in bridged form. Whether that is 5 minutes or 5 months, if the bridge is exploited while your assets are bridged, you lose them. Speed of withdrawal does not eliminate the window of exposure.
Keep Reading
Sources & Further Reading
- L2Beat Bridges
Risk assessments for all major cross-chain bridges
- Across Protocol
Intent-based bridge with fast finality and competitive fees
Questions People Also Ask
- Which bridges are safest?
- Native rollup bridges (Arbitrum bridge, Optimism bridge, zkSync bridge) are safest because they inherit L1 security. For fast bridging between chains: Across Protocol and CCIP (Chainlink) are considered among the more secure third-party options. Avoid bridges with small, anonymous validator sets or no audit history.
- What happened with the Wormhole hack?
- February 2022: a vulnerability in Wormhole's Solana-side contract allowed an attacker to mint 120,000 wrapped ETH on Solana without actually depositing ETH on Ethereum. Jump Crypto (Wormhole's backer) covered the $320M loss by replenishing reserves. Users were made whole, but only because a VC firm chose to absorb the loss.
- Can I bridge without a third-party bridge?
- Between Ethereum and its official rollups: yes, the canonical bridges are protocol-native. Between unrelated L1 chains (Ethereum and Solana, Bitcoin and Ethereum): a bridge is always required because the chains have no native connection. The question is which bridge to trust.