You send 500 USDC from Ethereum to Arbitrum, and a few minutes later they reappear on the other side. Behind this sleight of hand, a bridge is at work. According to Chainalysis, decentralized finance accounted for 82.1% of all crypto hacked in 2022 and bridges for 64% of that haul, so 0.821 × 0.64 = 52.5% of all stolen funds that year (¹). One stolen dollar in two! The tool that saves you time and fees also attracts the most seasoned hackers on the planet. A troubling paradox. Definition, mechanics, use cases, dangers and step-by-step instructions: here is what you need to know before crossing.
Key takeaways
📋 Index
- A crypto bridge connects two blockchains that cannot communicate with each other on their own.
- A wrapped token is only worth as much as its reserve.
- In 2022, bridges accounted for 52.5% of all stolen cryptocurrencies.
- To evaluate a bridge, count the operators rather than the keys.
- A withdrawal via an optimistic rollup can take up to 6.4 days.
Crypto bridge: a link thrown between two blockchains
Every blockchain lives in a silo. Bitcoin knows nothing about Ethereum. Same for Solana. Their validation rules differ, and so do their transaction formats, which means no token can cross the border on its own. A crypto bridge, or cross-chain bridge, fills that gap: it carries assets and messages from one network to another.
Picture two islands with no ferry service. Each one mints its own currency, runs its own shops, houses its own residents. The bridge does not physically carry your coins from one shore to the other. It holds them at departure and hands you an equivalent on arrival.
Do your coins really travel? Rarely. What moves is a promise of backing.
Lock, mint, burn: three mechanisms behind the scenes
Ethereum’s documentation lists three main methods. The first, and most common: lock and mint. Your tokens stay locked in a smart contract on the source chain, while a so-called “wrapped” version appears on the destination chain. The second approach: destroy the asset at departure, then issue a fresh one on arrival. The third route, the atomic swap, trades your tokens directly for those of a counterparty on the other network.
One detail changes everything. Where the collateral sleeps.
The wrapped token, a digital IOU
Take WBTC. Ethereum.org describes it as a version of bitcoin native to Ethereum, not the original asset. Its value therefore rests entirely on the reserve backing it. This is where it gets dizzying… a breach in that reserve hits every holder of the wrapped token, including people who never used the bridge. You can suffer a bridge hack without having used it even once.
Trusted bridges versus trustless bridges
Ethereum.org sorts bridges into two families. The first rely on an operator or a committee that holds the funds and validates transfers. The second hand these tasks to code and algorithms, without adding a new intermediary. Between these two extremes, many projects adopt hybrid models.
| Criterion | Trusted bridge | Trustless bridge |
|---|---|---|
| Who validates transfers? | An entity or a group of validators | Smart contracts |
| Custody of assets | You hand control to the operator | You keep control of your funds |
| Security level | Depends on the operator’s reputation | Matches that of the connected chains |
| Specific risks | Censorship, collusion between operators to divert funds | Code bugs, software failure |
| Mental picture | A safe entrusted to a notary | A time-lock safe |
But that’s not all. You still need a reason to cross.
What is a crypto bridge used for day to day?
The first reason, and the most down-to-earth: paying less. Ethereum mainnet gets expensive as soon as traffic picks up. Layer 2 networks process more transactions for lower fees. Moving your ETH to one of them through a bridge opens the door to lighter transactions.
The second reason: chasing a better yield. Take Lea, who lends stablecoins on an app deployed on Ethereum. She spots the same app deployed on another chain, offering a more generous return. Without a bridge, she cannot move her funds there without a detour.
The third reason is curiosity. Trying out the native apps of another ecosystem means bringing tokens there. The fourth and last reason: getting hold of a native asset, for instance converting WBTC into real bitcoin, or making the reverse trip to put your BTC to work in Ethereum’s decentralized finance.
Wouldn’t an exchange do the job? Sometimes. Ethereum.org points out, however, that if your funds already sit in your wallet, going through an exchange adds steps. The bridge links the two shores directly.
One awkward question remains. Why do so many hackers prowl around these structures?
52.5% of the 2022 loot: when the bridge becomes a honeypot
Chainalysis uses a striking image: the “honeypot”. A lock-based bridge piles up in a single contract all the collateral for every token issued elsewhere. The bigger it grows, the more profitable the smallest flaw becomes.
The burglar doesn’t target every house on the street. He targets the bank.
Ronin, Wormhole, Nomad: three breaches that defined 2022
| Bridge | Period | Assets stolen | Point of failure |
|---|---|---|---|
| Ronin (Axie Infinity) | March 2022 | 173,600 ETH and 25.5 million USDC, over 600 million dollars | Compromised validator private keys |
| Wormhole | 2022 | 120,000 wETH, or 325 million dollars | Smart contract flaw |
| Nomad | August 2022 | 190 million dollars according to Chainalysis | Software update exploited from more than 300 addresses |
Three bridges. Three different scenarios. One thing in common: none of the connected blockchains gave way.
The 5-of-9 signature threshold, a deceptive decentralization
On Ronin, nine validators guarded the bridge and five signatures were enough to approve a withdrawal, a threshold of 55.6% (²). The problem: Sky Mavis alone controlled four of those keys, so 44.4% of the validation power. The attacker didn’t have to break through nine defenses. Infiltrating two organizations was enough. According to the report published by Ronin, it all began with an employee caught by a targeted phishing attempt, followed by an access at Axie DAO left open since late 2021.
The theft took place on March 23. Nobody noticed for six days. A user unable to withdraw 5,000 ETH raised the alarm.
The lesson? Count the operators, not the keys.
September 2026: the Liquid Network affair
Recent news extends the list. In early September 2026, hackers presenting themselves as white hats exploited a bug in Liquid Network, a Bitcoin sidechain. Chainalysis reports that they created L-BTC without any real deposit, then swapped it for actual bitcoin: around 4,000 BTC out of the roughly 4,200 in the reserve, or 95.2% of the vault (³). They returned 3,400. As of September 9, 600 BTC were still missing, that is 14.3% of the initial reserve.
Bitcoin itself didn’t flinch. Only the middle layer gave way.
⚠️ Note
Ronin, Wormhole, Nomad, Liquid: four major incidents, and not a single main chain compromised. Breaches consistently lodge in the layer above, whether through poorly distributed keys, a poorly verified contract, a botched update or a faulty validation cache. A wrapped token is therefore never worth more than the weakest link in the chain of trust behind it, however robust the blockchains at each end may be.
Vitalik Buterin anticipated this paradox as early as January 2022.
“The future will be multi-chain, but it will not be cross-chain.” — Vitalik Buterin, Ethereum co-founder, January 7, 2022
His reasoning is worth a closer look. Nobody would launch a 51% attack against a major blockchain to grab a handful of wrapped tokens. With millions of ETH locked in a bridge, the math changes. Buterin describes a reverse network effect: a lightly used bridge stays relatively safe; a heavily used one becomes a prime target.
Should you give up on bridges, then? No. You need to learn how to cross them.
Using a crypto bridge in seven steps
Ethereum’s official guide describes a typical route to a layer 2. Here is its logic, enriched with the checks that prevent nasty surprises.
- Choose the destination network based on what you plan to do there: available apps, fees, maturity.
- Check the L2BEAT risk analysis, recommended by Ethereum.org, to compare candidate bridges.
- Go to the native bridge of the target network by typing its official address yourself.
- Connect your wallet and make sure it points to the source network.
- Enter the amount, then check the sum received on arrival and the displayed fees.
- Confirm the transaction in your wallet and pay the network fees in ETH.
- Wait, then add the new network to your wallet so your tokens show up.
For deposits, Ethereum.org announces a wait that should not exceed ten minutes. Fast. Too fast, perhaps, for those who forget that the way back follows different rules.
💡 Tip
Before transferring a large sum, send a small test amount and keep some of the native fee token on the destination chain. Arbitrum’s documentation actually requires ETH on both sides to complete a withdrawal. Without that reserve, your tokens do reach their destination, but they stay stuck, with no fuel to pay for the slightest transaction.
In within ten minutes, out after six days
Optimistic rollup networks, such as Arbitrum One, impose a challenge period before a withdrawal to Ethereum is finalized. How long? 6.4 days according to Arbitrum’s official documentation. During that window, any validator can flag a fraudulent transaction.
Do the math: 6.4 days equals 9,216 minutes, making the return trip 922 times longer than the way in (⁴). The bridge looks like a toll highway whose exit lane has shrunk to a footpath.
Third-party bridges offer faster exits. The price? Additional trust assumptions.
🚫 Pitfall
Withdrawing funds from a layer 2 through the native bridge while expecting to get them back within the hour, to settle a payment or seize a market opportunity. The mistake stems from a misunderstood asymmetry: the deposit arrives in minutes, which suggests the return will follow the same pace. Yet on an optimistic rollup, the challenge period locks the money up for nearly a week, with no way to speed things up through the official bridge.
French taxation: what the law says
Does a bridge transfer trigger tax in France? Not necessarily. Article 150 VH bis of the French General Tax Code excludes from taxation, in the year of the transaction, exchanges between digital assets made without any cash balance (⁵). Moving from a token to its wrapped version resembles that kind of exchange. Tax does apply, however, when converting to euros or buying goods, beyond 305 euros of annual disposals. Since the 2026 Finance Act, the flat tax has risen to 31.4%. Every situation is different: have yours checked by a professional.
Bridge or exchange: the face-off
The crypto community keeps repeating an old saying: “not your keys, not your coins”. The choice between a bridge and a centralized exchange largely revolves around that maxim.
| Criterion | Crypto bridge | Centralized exchange |
|---|---|---|
| Key control | You keep them (depending on bridge type) | The exchange holds them |
| Funds already in your wallet | Direct route | Deposit, conversion, then withdrawal |
| Funds already on the exchange | Prior withdrawal required | Direct withdrawal possible to some layer 2s |
| Main risk | Code or validator flaw | Exchange failure |
No option wins on every count. It all depends on where your funds are to begin with.
In the end, the crypto bridge resembles the suspension bridges of the 19th century: essential to trade, spectacular, and still in a learning phase. Ethereum.org openly admits that the ideal design has probably not been found yet. So cross them. But watch where you step.
Sources and statistics
(1) Chainalysis’s 2022 report puts thefts at 3.8 billion dollars, 82.1% of which hit decentralized finance, and specifies that 64% of that amount targeted bridges. Multiplying the two shares (0.821 × 0.64) gives 52.5% of the total stolen, just under 2 billion dollars (3.1 × 0.64 ≈ 1.98).
(2) Ronin’s post-mortem report states nine validators and a five-signature threshold: 5 ÷ 9 = 55.6%. Sky Mavis controlled four of them, so 4 ÷ 9 = 44.4%. This breakdown shows that the attacker only had to compromise two entities, not five.
(3) The analysis published by Chainalysis on September 9, 2026 mentions around 4,000 BTC withdrawn out of roughly 4,200 in reserve: 4,000 ÷ 4,200 ≈ 95.2%. With 3,400 BTC returned, 600 BTC remained at large, or 600 ÷ 4,200 ≈ 14.3% of the starting reserve.
(4) Ethereum.org’s guide announces a deposit to a layer 2 in ten minutes at most, and Arbitrum’s documentation a 6.4-day challenge period for withdrawals. Conversion: 6.4 × 1,440 = 9,216 minutes, then 9,216 ÷ 10 ≈ 922.
(5) Section II-A of Article 150 VH bis of the French General Tax Code provides for tax deferral on exchanges between digital assets without a cash balance, and section II-B for an exemption below 305 euros of annual disposals. The 31.4% rate comes from the 2026 Finance Act, as presented by the law firm CMS. Applying these rules to a bridge transfer reflects our own reading of the text.
