# Bridge and Smart Contract Risk

> Smart contract bugs and cross chain bridge hacks have cost crypto users billions. Learn how bridges work, famous exploits, warning signs and how to reduce your risk.

Source: https://learn.tradelabsai.com/crypto/bridge-and-smart-contract-risk/  
Track: Crypto · Level: Advanced · Updated: 2026-10-03  
Publisher: TradeLabs AI (https://tradelabsai.com). Education, not financial advice.  
Cite as: TradeLabs Learn, "Bridge and Smart Contract Risk", https://learn.tradelabsai.com/crypto/bridge-and-smart-contract-risk/

In crypto, code is in charge. Smart contracts hold billions of dollars and execute automatically, which means a single bug can let an attacker drain funds in minutes, with little chance of reversal. Cross chain bridges, which move assets between blockchains, have been among the biggest targets because they concentrate large pools of locked assets. Understanding these risks is essential before using DeFi protocols, wrapped tokens or bridges.

## What smart contract risk means

| Risk | Example |
|---|---|
| Coding bugs | A logic error lets anyone withdraw more than they deposited |
| Reentrancy | A contract is called again before it updates balances, as in the 2016 DAO hack |
| Oracle manipulation | Bad price data allows undercollateralised borrowing. See [Oracles](https://learn.tradelabsai.com/crypto/oracles/) |
| Access control failures | Admin keys or upgrade permissions are compromised |
| Economic design flaws | Incentives that can be gamed with flash loans |
| Upgrade risk | A protocol changes its code, introducing new bugs |

## How bridges work

A typical bridge locks tokens on one chain and mints a "wrapped" version on another. When users bridge back, the wrapped tokens are burned and the originals released.

**Example: Why bridges are targets**
A bridge holds 100,000 ETH locked on Ethereum, backing 100,000 wrapped ETH on another chain. If an attacker tricks the bridge into releasing the locked ETH, or into minting wrapped ETH without a deposit, the wrapped tokens lose their backing. Holders of wrapped ETH on the other chain suddenly own tokens worth far less than they thought. One successful attack can drain the entire pool.

## Major exploits

| Year | Incident | Approximate loss |
|---|---|---|
| 2016 | The DAO (reentrancy bug) | About $60 million in ETH at the time |
| 2022 | Ronin bridge (Axie Infinity): validator keys compromised | About $620 million |
| 2022 | Wormhole bridge: signature verification flaw | About $320 million |
| 2022 | Nomad bridge: faulty update let anyone copy exploit transactions | About $190 million |
| 2025 | Bybit exchange wallet compromise (not a bridge, but a multisig signing attack) | About $1.5 billion |

US authorities attributed the Ronin and Bybit attacks to North Korean hacking groups. According to blockchain analytics firms, crypto hacks have stolen billions of dollars a year in some years, with bridges a leading category in 2022.

## Types of bridges

| Type | Trust model | Risk profile |
|---|---|---|
| Custodial or federated | A company or small group of signers controls funds | Key compromise, insider risk |
| Multisig bridges | A set number of signers must approve | Risk if enough keys are stolen |
| Light client or proof based | Verify the other chain's state cryptographically | Lower trust, more complex code |
| Native rollup bridges | Ethereum layer 2s with settlement to layer 1 | Depends on rollup security and upgrade keys |

## Warning signs

- **Unaudited or newly deployed code.**
- **Anonymous teams** with no track record.
- **Extremely high yields** with no clear source.
- **Small number of admin keys** controlling large funds.
- **Rapid, unexplained TVL growth.**
- **Unclear upgrade processes.**

Audits reduce but do not eliminate risk; many exploited protocols had been audited.

## How to reduce your risk

1. **Use established, battle tested protocols** with long track records.
2. **Limit exposure** to any single protocol or bridge.
3. **Prefer native assets** over wrapped tokens when possible.
4. **Check audits, bug bounties and admin key setups.**
5. **Bridge only what you need,** and do not leave funds sitting in bridge contracts.
6. **Revoke token approvals** you no longer use.
7. **Use hardware wallets** and verify contract addresses. See [Identifying Trading Scams](https://learn.tradelabsai.com/start-here/identifying-trading-scams/).

## Insurance and recovery

Some DeFi insurance protocols offer coverage against smart contract failures, with their own risks and limits. Recovery after hacks is rare but has happened through negotiations, white hat returns or law enforcement seizures. Do not count on it.

## Frequently asked questions

### What is smart contract risk?

The risk that bugs, design flaws or compromised permissions in blockchain code allow funds to be lost or stolen.

### Why are crypto bridges hacked so often?

They hold large pools of locked assets and rely on complex code or small groups of signers, making them attractive, high value targets.

### How can I protect myself from DeFi hacks?

Use established, audited protocols, limit exposure to any one platform, avoid unnecessary bridging and manage wallet approvals carefully.

Next, learn about earning rewards by securing networks in [Staking and Restaking](https://learn.tradelabsai.com/crypto/staking-and-restaking/).

## Continue learning

- Next lesson: [Staking and Restaking](https://learn.tradelabsai.com/crypto/staking-and-restaking/)
- Previous lesson: [Mempools and Gas](https://learn.tradelabsai.com/crypto/mempools-and-gas/)
- Related: [Mempools and Gas](https://learn.tradelabsai.com/crypto/mempools-and-gas/): Pending crypto transactions wait in the mempool and pay fees to be included. Learn how Bitcoin fees and Ethereum gas work, EIP 1559 and how to avoid overpaying.
- Related: [DeFi Basics](https://learn.tradelabsai.com/crypto/defi-basics/): DeFi offers trading, lending and borrowing through smart contracts instead of banks. Learn the building blocks, where yields come from and the risks.
- Related: [Oracles](https://learn.tradelabsai.com/crypto/oracles/): Oracles bring outside data like prices and event results onto blockchains. Learn how Chainlink feeds and UMA's optimistic oracle work, and how attacks happen.
- Related: [Stablecoins](https://learn.tradelabsai.com/crypto/stablecoins/): Stablecoins are crypto tokens designed to hold a steady value, usually $1. Learn how fiat backed, crypto backed and algorithmic stablecoins work, and their risks.
- Related: [Operational and Model Risk](https://learn.tradelabsai.com/portfolio/operational-and-model-risk/): Operational risk comes from failed processes, people and systems; model risk from wrong or misused models. Learn real examples and the key controls.
- Related: [Identifying Trading Scams](https://learn.tradelabsai.com/start-here/identifying-trading-scams/): The most common trading scams, from fake platforms and pump and dumps to signal groups and recovery scams, with warning signs and steps to protect yourself.