Explainer · Bridges
Crypto bridges, explained
October 6, 2026
Bitcoin and Ethereum are separate, closed systems, each with its own validators and its own history — there is no built-in way for one to read or trust what happened on the other. A bridge is the piece of infrastructure that gets around that, and it has also lost more money to exploits than almost any other category in crypto. Here is what a bridge actually does, the two common ways to build one, and why the design itself concentrates risk.
Why chains can't just talk to each other
Each blockchain is its own closed, independent system, with its own separate set of validators agreeing on its own separate history. There is no shared referee between them, and no built-in way for one chain to directly read or trust what happened on another. An asset native to one chain simply does not exist on a different chain's ledger — not because of a technical restriction, but because the two were never designed to share a single, unified state in the first place.
That is the problem a bridge exists to solve. Nothing can actually move between two independent ledgers, so a bridge coordinates a matched pair of actions on both chains at once, and the result looks like a transfer even though nothing physically crossed.
Two ways to build one
- Lock-and-mint. The original asset is deposited into a smart contract on the source chain, where it is locked up. In response, an equivalent, newly-created token is minted on the destination chain — a placeholder often called a "wrapped" version of the asset. Reversing the process burns the wrapped token and unlocks the original. A claim is created on one side, backed by a lock on the other.
- Liquidity-pool. Instead of minting a new wrapped token, the bridge holds a real pool of the native asset on both chains already. A transfer pays out from the destination chain's existing pool while topping up the source chain's pool with what was deposited — closer to a currency exchange than a lock-and-mint. It avoids wrapped-token risk, but only works as long as each side's pool actually holds enough of the asset to pay out.
Why bridges keep getting hacked
A bridge has to hold a large, concentrated pool of locked assets on one side — a single, valuable target — while some separate system decides when to mint, burn, or release funds on the other side. That decision-making layer is exactly the kind of custom, complex software that is hardest to make airtight, and a flaw in it can mean draining everything the bridge holds, all at once.
This is a structural feature of the design, not a sign that bridge developers are careless. The design concentrates a large amount of value behind one piece of software that has to make trust decisions across two entirely separate systems, and that combination — concentrated value plus custom cross-chain logic — is exactly what makes bridges the most-exploited category of infrastructure in crypto. The exploit history is well documented at the category level; it reflects the structure, not any one project's execution.
What to check before using one
A few questions do most of the work before moving meaningful funds across a bridge. How long has it operated without an incident, and has it been independently audited? Is it a lock-and-mint design or a liquidity-pool design — and either way, who or what actually controls the release of funds on the destination side? And is there a simpler, official path between these two specific chains that skips a third-party bridge entirely?
The safest bridge is often the one that was not needed at all.
The read
Bridges solve a real problem — crypto genuinely needs a way to move value between separate chains — but the same design that makes that possible concentrates risk in a way most of the rest of crypto does not. That is exactly why bridge exploits sit near the top of any accounting of losses across the industry, and why knowing what a given bridge is actually asking a user to trust is worth checking before, not after.
This is general-circulation educational content, not investment or legal advice. Nothing here is a recommendation to use any specific bridge, protocol, or chain.
For a running accounting of losses across the industry, see Blockchain IQ's Exploit Losses coverage.