Blockchains cannot see each other. Bitcoin's network has no idea what happens on Ethereum, and Ethereum cannot check a balance on Solana or on one of its own layer 2 networks. A bridge fills that gap with a set of contracts, signers or relayers that watch one chain and act on another, so a token can effectively move across. That convenience comes at a price: the bridge, not the underlying blockchains, decides whether a transfer is genuine, and bridges have lost billions of dollars when that judgment failed. This guide covers how the main designs work, the difference between official and third-party bridges, what a transfer actually costs, the largest hacks and a checklist to run before bridging. The crypto hub covers the wider market.
What is a crypto bridge?
A crypto bridge moves tokens or messages between blockchains by locking, burning or paying out assets on one chain in response to events on another.
Nothing physically travels. When ETH is "bridged" from Ethereum to a layer 2, the original coins usually stay locked in a contract on Ethereum, and a matching balance is created on the other chain. The two sides stay in step only as long as the bridge's verification works: some mechanism has to confirm that the deposit on chain A really happened before the payout on chain B. Depending on the design, that mechanism might be a rollup's proof system, a committee of validators, a multisig wallet, an issuer's attestation service or a single verifier.
Bridges hold a great deal of money. DefiLlama listed about $61 billion locked in bridge protocols and another $12.2 billion in chains' canonical bridges on its categories page on November 2, 2026. Every dollar of that is collateral for tokens circulating somewhere else, which is why a bridge failure can leave thousands of holders with tokens that are suddenly worth less than they seemed.
How do lock-and-mint, burn-and-release and liquidity bridges work?
Lock-and-mint bridges lock originals and issue wrapped copies, burn-and-release reverses that on the way back, and liquidity bridges pay out from pools already on the destination.
| Design | How a transfer works | What arrives | Main point of trust |
|---|---|---|---|
| Lock and mint | Tokens are locked in a contract on the source chain and a wrapped version is minted on the destination | A wrapped token backed by the locked originals | The contract holding the locked tokens and whoever approves new mints |
| Burn and release | The return trip: the wrapped tokens are burned and the bridge releases the locked originals on their home chain | The original token | The same contract and approvers, which must still hold enough collateral |
| Native burn and mint | The issuer's system destroys tokens on the source chain and mints the same token on the destination | The native token, not an IOU | The issuer's message verification |
| Liquidity network | A relayer pays the user from funds already on the destination chain, then is repaid from the user's deposit | Native tokens already on the destination | Relayers, the settlement system and the depth of the pools |
Lock and mint is the oldest design and still the most common. Deposits from Ethereum into a rollup work this way, and withdrawals are the burn-and-release leg: the layer 2 balance is destroyed and the locked ETH is released on Ethereum once the withdrawal is proven. The Liquid Network's two-way peg works the same way for bitcoin, which a federation of 15 functionaries holds while L-BTC circulates on its sidechain. The weakness is concentration. All the collateral sits in one place, and if wrapped tokens are ever minted or redeemed without a matching deposit, the originals run out for everyone else.
Native burn and mint suits tokens whose issuer runs both sides. Circle's Cross-Chain Transfer Protocol burns USDC on the source chain and mints native USDC on the destination, with no pool of locked tokens; its docs put a fast transfer at about 8 to 20 seconds and a standard one at 15 to 19 minutes between Ethereum and layer 2s. How stablecoins work explains why native and bridged versions of the same coin are different assets, and sending money with stablecoins covers using them for payments.
Liquidity networks trade trust for speed. Professional relayers front the money on the destination chain within seconds and collect the user's deposit, plus a fee, once the transfer settles through a slower route behind the scenes.
What is the difference between canonical and third-party bridges?
A canonical bridge is the official route built into a rollup or chain, while a third-party bridge is run by an outside protocol with its own operators.
A rollup's canonical bridge is secured by the same proofs that secure the rollup, so it adds little extra trust, but optimistic rollups make withdrawals through it wait out a challenge window. Base's official route took 5 days with a single proof on November 2, 2026, and other optimistic rollups take 6 to 7; layer 2 networks explained sets out each network's delay and the councils that can override it. Deposits in the other direction arrive within minutes.
Third-party bridges connect chains that have no official link and skip the waits, but each adds its own security model. Some rely on a committee whose keys can be stolen, some on a messaging network whose verification an app configures itself, and some on relayers who must stay solvent and online. They also tend to issue their own wrapped tokens, so the same asset can exist in several incompatible versions on one chain. A token bridged one way may not be accepted by an exchange or app that expects another, a problem sending crypto to the wrong network covers.
What does it cost to bridge crypto?
Bridging costs gas on each chain plus any bridge fee: moving 1 ETH from Base to Ethereum cost about 9 cents officially or $1.23 through a fast bridge. Those figures are from November 2, 2026, and both move with network congestion.
Worked example: Moving 1 ETH from Base to Ethereum on November 2, 2026
Assumptions: Ethereum gas at 0.054 gwei (the 24-hour average base fee plus the median tip), ETH at $2,300, and gas amounts measured from recent transactions on Base's official bridge contracts.
Official route, about 5 days:
- Start the withdrawal on Base: a fraction of a cent (Base's median transaction cost $0.0014 on October 31)
- Prove it on Ethereum: about 413,000 gas × 0.054 gwei = 22,302 gwei, about $0.051
- Finalize it on Ethereum after the 5-day window: about 302,000 gas × 0.054 gwei = 16,308 gwei, about $0.038
- Total: about $0.09, and the full 1 ETH arrives
Fast route, quoted at about 04:04 UTC by a liquidity-network bridge:
- Fee: 0.00035 ETH relayer capital fee + 0.000181 ETH liquidity-provider fee + 0.000005 ETH relayer gas = 0.000536 ETH, or 0.054%
- Received on Ethereum: 0.999464 ETH, in an estimated 8 seconds
- Cost: 0.000536 × $2,300 ≈ $1.23, plus a fraction of a cent of Base gas to send the deposit
The fast route cost about $1.14 more and saved five days, at the price of trusting the relayer and the bridge's contracts. The official route's cost is almost entirely Ethereum gas, which makes it sensitive to congestion: at the median price paid in the peak block of the October 29, 2026 surge, 254.75 gwei, the same proving and finalizing transactions would have cost about 715,000 × 254.75 = 182,146,250 gwei, roughly 0.182 ETH or $411 at that evening's ETH price of about $2,256. Because the finalizing step can be sent any time after the window ends, it does not have to be done at a busy moment. Going the other way is cheaper: an ETH deposit through Base's official bridge used about 620,000 gas, roughly 8 cents at the same gas price, and arrived in minutes. Gas fees explained covers how those gas prices are set.
What were the biggest bridge hacks?
The largest bridge hacks each took roughly $100 million or more, through stolen keys, code bugs, faulty upgrades or a weakly configured verifier.
| Date | Bridge | Loss | What failed |
|---|---|---|---|
| February 2, 2022 | Wormhole (Solana and Ethereum) | 120,000 wrapped ETH minted with no backing, about $322 million at that day's price | A flaw in signature verification on the Solana side; trading firm Jump replaced the ETH |
| March 23, 2022 | Ronin (Axie Infinity's sidechain) | 173,600 ETH and 25.5 million USDC, about $620 million according to the FBI | Attackers controlled 5 of the 9 validator keys; the FBI attributed the theft to North Korea's Lazarus Group |
| June 24, 2022 | Harmony Horizon | About $100 million | The bridge depended on a 2-of-5 multisig, and two keys were compromised |
| August 1, 2022 | Nomad | More than $186 million | An upgrade let messages pass without a valid proof, and hundreds of copycats joined in |
| October 6, 2022 | BNB Chain Token Hub | 2 million BNB, about $590 million at that day's price, minted with a forged proof | Validators halted the chain; BNB Chain said about $100 million left it first |
| April 18, 2026 | KelpDAO rsETH, built on LayerZero | 116,500 rsETH, about $292 million | A single required verifier was fed false chain data from poisoned servers; security firms cited by LayerZero attribute it to North Korea's TraderTraitor |
| September 6, 2026 | Liquid Network | About 4,000 BTC, about $319 million at that day's price | A cache bug in the Elements software let unbacked L-BTC be redeemed for real bitcoin, cutting the reserve from about 4,205 BTC to 197 |
The pattern has been consistent. By August 2022, Chainalysis counted 13 bridge hacks worth about $2 billion, most of it taken that year, and North Korean groups were blamed for several of the largest. The 2026 cases show the risk moving rather than disappearing: KelpDAO's route accepted a message signed by one verifier, and the Liquid bug had sat in widely used code since 2018. Recovery varies. Jump replaced the ETH missing from Wormhole, about 17% of the Nomad losses had been handed back by August 9, 2022, and Arbitrum's Security Council froze part of the KelpDAO proceeds, but stolen funds are rarely returned in full.
How can you check a bridge before using it?
Before signing, check how the bridge verifies transfers, which token version arrives on the destination chain, and what the transfer costs and how long it takes.
Before bridging
- Reach the bridge through the network's official documentation or a saved bookmark, never a search ad or a link sent in a chat
- Find out who verifies transfers: the rollup's own proofs, a committee or multisig and how many signers it has, or a single verifier
- Confirm the token that arrives is the version exchanges and apps on that chain accept, by its contract address, not its ticker
- Make sure the receiving address supports that network and keep a little of the destination's gas token, which is ETH on most Ethereum rollups
- Compare the quoted fee and arrival time with the official route, and remember that an official withdrawal from an optimistic rollup cannot be cancelled once started
- Approve only the amount being moved, and revoke the bridge's token approval afterward
- Check the project's official channels for pauses or incidents that day
- Send a small amount first, and never bridge more than you could afford to have stuck or lost
A legitimate bridge never needs a seed phrase, and support staff do not start conversations in direct messages. Fake bridge sites and impostor support accounts are a common way funds disappear; crypto scams describes the patterns, and how to store crypto safely covers protecting the keys that sign bridge transactions.
What are the risks of using a crypto bridge?
The main risks are theft through stolen keys or code bugs, wrapped tokens losing their backing, frozen or delayed funds, user mistakes and price swings mid-transfer.
- Key and signer compromise. Bridges guarded by a few keys fall when those keys do, as Ronin's 5-of-9 validator set and Harmony's 2-of-5 multisig showed.
- Code and verification bugs. Wormhole, Nomad, BNB Chain's Token Hub and Liquid all failed in their verification logic, and a bug can drain the whole pool at once.
- Misconfiguration. On messaging networks, each app chooses how many verifiers must agree; KelpDAO's single-verifier setup turned one compromised system into a $292 million loss.
- Wrapped tokens losing backing. A wrapped token is only as good as the collateral behind it, and after a hack it can trade well below the asset it represents.
- Freezes and pauses. BNB Chain's validators halted the whole network in 2022, and rollup security councils can freeze balances, which protects victims but can also trap ordinary users' funds.
- Mistakes in transit. Sending to an unsupported chain, choosing the wrong token version or misreading a fee quote can strand funds with no one to reverse it.
- Price risk while waiting. During a five- to seven-day official withdrawal the asset keeps moving in price, and crypto is volatile enough to lose most or all of its value, as the ether price page shows.