Bridge and Smart Contract Risk in Crypto Explained

Bridge and Smart Contract Risk

Smart contract bugs and cross chain bridge hacks have cost crypto users billions. Learn how bridges work, famous exploits, warning signs and how to reduce your risk.

Advanced3 min readUpdated 3 Oct 2026

Lesson 21 of 24

In crypto, code is in charge. Smart contracts hold billions of dollars and execute automatically, which means a single bug can let an attacker drain funds in minutes, with little chance of reversal. Cross chain bridges, which move assets between blockchains, have been among the biggest targets because they concentrate large pools of locked assets. Understanding these risks is essential before using DeFi protocols, wrapped tokens or bridges.

What smart contract risk means#

Risk	Example
Coding bugs	A logic error lets anyone withdraw more than they deposited
Reentrancy	A contract is called again before it updates balances, as in the 2016 DAO hack
Oracle manipulation	Bad price data allows undercollateralised borrowing. See Oracles
Access control failures	Admin keys or upgrade permissions are compromised
Economic design flaws	Incentives that can be gamed with flash loans
Upgrade risk	A protocol changes its code, introducing new bugs

How bridges work#

A typical bridge locks tokens on one chain and mints a "wrapped" version on another. When users bridge back, the wrapped tokens are burned and the originals released.

Major exploits#

Year	Incident	Approximate loss
2016	The DAO (reentrancy bug)	About $60 million in ETH at the time
2022	Ronin bridge (Axie Infinity): validator keys compromised	About $620 million
2022	Wormhole bridge: signature verification flaw	About $320 million
2022	Nomad bridge: faulty update let anyone copy exploit transactions	About $190 million
2025	Bybit exchange wallet compromise (not a bridge, but a multisig signing attack)	About $1.5 billion

US authorities attributed the Ronin and Bybit attacks to North Korean hacking groups. According to blockchain analytics firms, crypto hacks have stolen billions of dollars a year in some years, with bridges a leading category in 2022.

Types of bridges#

Type	Trust model	Risk profile
Custodial or federated	A company or small group of signers controls funds	Key compromise, insider risk
Multisig bridges	A set number of signers must approve	Risk if enough keys are stolen
Light client or proof based	Verify the other chain's state cryptographically	Lower trust, more complex code
Native rollup bridges	Ethereum layer 2s with settlement to layer 1	Depends on rollup security and upgrade keys

Warning signs#

Unaudited or newly deployed code.
Anonymous teams with no track record.
Extremely high yields with no clear source.
Small number of admin keys controlling large funds.
Rapid, unexplained TVL growth.
Unclear upgrade processes.

Audits reduce but do not eliminate risk; many exploited protocols had been audited.

How to reduce your risk#

Use established, battle tested protocols with long track records.
Limit exposure to any single protocol or bridge.
Prefer native assets over wrapped tokens when possible.
Check audits, bug bounties and admin key setups.
Bridge only what you need, and do not leave funds sitting in bridge contracts.
Revoke token approvals you no longer use.
Use hardware wallets and verify contract addresses. See Identifying Trading Scams.

Insurance and recovery#

Some DeFi insurance protocols offer coverage against smart contract failures, with their own risks and limits. Recovery after hacks is rare but has happened through negotiations, white hat returns or law enforcement seizures. Do not count on it.

Frequently asked questions#

What is smart contract risk?#

The risk that bugs, design flaws or compromised permissions in blockchain code allow funds to be lost or stolen.

Why are crypto bridges hacked so often?#

They hold large pools of locked assets and rely on complex code or small groups of signers, making them attractive, high value targets.

How can I protect myself from DeFi hacks?#

Use established, audited protocols, limit exposure to any one platform, avoid unnecessary bridging and manage wallet approvals carefully.

Next, learn about earning rewards by securing networks in Staking and Restaking.

Check your understanding

3 quick questions on this lesson. Get them all right to finish it.

Turn on JavaScript to take the quiz.

Finished this lesson?Sign in to save your progress across devices.

Next lessonStaking and RestakingStaking locks proof of stake tokens to secure a network and earn rewards; restaking reuses staked tokens for more yield. Learn how both work and the risks.