Bridges Are the Weakest Link
Some of the biggest single losses in DeFi came through bridges, not through the chains themselves. Ronin lost $625 million. Wormhole lost $320 million. Nomad lost $190 million. Add up bridge exploits and you clear $2 billion. That is not random. Bridges hold huge pools of locked assets, their architecture spans multiple chains at once, and they lean on trust assumptions that are weaker than the blockchains they connect. If you were an attacker, that is exactly where you would go.
And yet traders bridge constantly without thinking about what they are trusting. Moving $50,000 from Ethereum to Arbitrum means trusting the bridge's smart contracts, its validator set or multisig, its off-chain infrastructure, and the wrapped token you get on the other side. Every one of those is a place things can break.
How Bridges Work and Where They Break
Most bridges run on lock-and-mint. You lock tokens on the source chain, the bridge mints wrapped tokens on the destination chain, and to reverse it you burn the wrapped tokens so the bridge unlocks your originals. The whole thing hinges on one question: how does the destination chain actually know you locked tokens on the source chain? That verification step is where the trust model lives, and where it fails.
Multisig bridges, like the original Ronin bridge, have a set of validators sign off on transactions. Compromise enough of them and the bridge drains. Ronin got hit exactly this way, with 5 of 9 validators compromised, which was enough to approve fraudulent withdrawals.
Optimistic bridges, in the Nomad style, assume transactions are valid unless someone challenges them inside a window. That lowers the trust assumption but opens a challenge period where a bad message could get through. Nomad's hack came from a misconfiguration in that verification logic that let anyone forge messages that looked valid.
Light-client bridges verify source-chain proofs on the destination chain, basically running a stripped-down version of the source chain's consensus check. It is the most trustless option and also the most complex and gas-heavy. IBC in the Cosmos ecosystem is the most mature version of this.
The Wrapped Asset Problem
Here is the part people miss. When you bridge USDC from Ethereum to Arbitrum, what lands on Arbitrum is not Circle's USDC. It is a wrapped version, backed 1:1 by the real USDC locked in the bridge contract back on Ethereum. So that wrapped token is only as safe as the bridge. If the bridge gets drained, the wrapped USDC on the other chain is worth nothing, no matter how solid Circle is.
Some assets fix this with native issuance on multiple chains. Circle now mints native USDC directly on Ethereum, Arbitrum, Base, Solana, and others. Native USDC is backed by Circle's reserves, not by tokens sitting in a bridge, so it carries no bridge risk. The shift from bridged to native is happening but it is far from finished, and plenty of tokens still depend on bridges to exist cross-chain.
All these wrapped variants also fragment liquidity. You can end up staring at USDC.e, USDC.b, and native USDC all floating around on the same chain. They are not fungible with each other, swapping between them costs slippage or fees, and holding the wrong one bites you if that bridge gets compromised or its liquidity dries up.
Liquidity and Slippage Risk
Security aside, bridges have plain practical problems too. A lot of them use liquidity pools for fast transfers instead of the slower lock-and-mint route. If the destination pool runs low because everyone is bridging the same direction, you either wait or eat a worse rate. In a stressed market, when everyone wants to pile onto the same chain at once, that liquidity can vanish fast.
Aggregators like Li.Fi, Socket, and Bungee compare routes across multiple bridges and DEXes to find the cheapest, fastest path. Usually that beats picking one bridge yourself, since the aggregator can route through whichever bridge has the best liquidity right then. The tradeoff is another layer of smart contract risk stacked on top of the bridge's own, because now you are trusting the aggregator's contracts too.
Practical Risk Management
If you have to bridge, a few habits cut the risk down.
- Use the most established bridge for each route. Longer track record, more audits, more volume moved without incident. Lower risk, not zero risk. For Ethereum L2s, the native rollup bridges (Arbitrum's own, Optimism's own) have the strongest guarantees because they inherit Ethereum's security instead of leaning on a separate validator set.
- Bridge in smaller batches. If the bridge has a hole and your whole portfolio is mid-transit, that is catastrophic. Splitting across transactions, and sometimes across bridges, caps what any single failure can take.
- Keep your time in wrapped form short. If you are bridging over to make a trade, do the trade and bridge back rather than parking assets in wrapped form for weeks. The longer you hold the wrapper, the longer you are exposed.
- Check the security model before you touch it. Is it a multisig, how many signers, who are they? Is there a timelock on upgrades? Has it been audited, and what did the audit actually find?
Those last questions are boring, which is probably why people skip them. A few minutes of reading beats handing your capital to a bridge whose trust assumptions you never looked at.