Every Major Bridge Hack and What Broke
Rift Research
Last updated
Bridge exploits account for more than $2.8 billion in losses since 2022, roughly 69% of all funds stolen from DeFi in that period. Trackers using different start dates and inclusion criteria report different totals; this figure and its 2022 start date come from a single consistent source. Almost none of them were cryptography failures. The chains worked. The signature schemes worked. What failed was a key held by a person, a verification routine that did not verify, a configuration changed during an upgrade, or an off-chain component nobody was auditing.
This page classifies incidents by what broke and what a user could have checked in advance. It is not a catalogue of every incident; several trackers do that better.
The short version
- Bridges are the most exploited component in crypto. More than $2.8 billion since 2022, roughly 69% of DeFi losses in that period.
- No major bridge hack broke the underlying cryptography. Every one failed at a trust component sitting beside it.
- Low thresholds were disproportionately targeted. Ronin required 5 of 9. Harmony required 2 of 5. Both fell.
- Two of the largest were verification routines that did not verify. Wormhole's signature check delegated to the wrong program and performed no check at all. Nomad's routine upgrade set the trusted root to zero, which made every proof valid.
- Recovery is rare and partial. Wormhole users were made whole by a backer, not the protocol. Nomad recovered roughly $36 million of $190 million. Harmony recovered nothing.
- The attack surface has moved. Contract exploits dominated 2022. Social engineering, supply-chain compromise and off-chain infrastructure dominate now.
On the figures. Where sources agree, a single number is used. Where they differ, the most widely reported figure is used and the variance is noted. Cumulative totals carry their start date, because trackers using different start dates and methodologies report materially different numbers.
Eight root causes, and what you could have checked
| Root cause | What happened | Example | What was checkable in advance |
|---|---|---|---|
| Key compromise | Enough signing keys were stolen through ordinary IT attack to meet the threshold | Ronin, March 2022, $624M (reported between $600M and $625M). Validator keys compromised through a fake job offer. Harmony Horizon, June 2022, ~$100M, 2-of-5 multisig | The threshold and whether signers are genuinely independent. Both were public before the attacks |
| Verification that did not verify | The contract accepted a signature set without checking it | Wormhole, February 2022, $326M, roughly 120,000 ETH. The verify_Signatures routine delegated to a stale program version, so no check was performed | Audit coverage of the verification path specifically, not audit count |
| Trusted root misconfiguration | An upgrade set a security parameter to a value that made every proof valid | Nomad, August 2022, ~$190M. A routine upgrade zeroed the trusted root | Upgrade process, timelock, and whether config changes are reviewed as code |
| Proof forgery | The proof system accepted a forged input | BNB Bridge, October 2022, reported at approximately $568M | Maturity and independent review of the proof system |
| Minting authority | Someone could mint tokens without adding backing | eBTC on Monad, May 2026, ~$76.6M. An admin key was compromised and the attacker called the mint function | Who can mint, and whether reserves are verifiable on-chain rather than by attestation |
| Off-chain coordination compromise | The contracts held. The infrastructure around them did not | Garden, October 2025 ( | Whether the off-chain layer is in audit scope at all. Usually it is not |
| Custody concentration | Not an attack. One party held the keys and became unavailable | Multichain, 2023. Users were still pursuing recovery through courts years later | Whether key distribution is disclosed, and what happens if one holder disappears |
| Standing user approvals | The protocol was not breached. Stale unlimited allowances were drained | Socket, 2024 | Your own approvals. This one is entirely under your control |
What does the pattern actually show?
The cryptography was never the weak point. Not once. Every incident above traces to a person, a configuration, a permission, or a server.
Warnings were often public. A researcher had identified Harmony's exact vulnerability and predicted the outcome. The threshold was not raised. The attack arrived 83 days later.
Low thresholds were selected for. Attackers went where fewer keys had to be compromised. A 2-of-5 is not a security model, it is two spear-phishing campaigns.
The failures were mundane. A fake job offer. A deprecated function left in place. A config value changed during a routine upgrade. None of these were novel cryptographic breaks.
Has the pattern changed?
Yes, and it matters for how you evaluate a bridge today.
2022 was the peak of contract exploits. Qubit, Wormhole, Ronin, Harmony, Nomad and BNB Bridge combined for roughly $1.9 billion in a single year. Most were smart contract flaws or key compromise.
The attack surface has since moved off-chain. Bridge exploits have been substantially replaced by social engineering and supply-chain compromise, with DPRK-linked activity attributed to a large share. Chainalysis attributed at least $2 billion in crypto theft to North Korean actors in 2025 alone.
Bridges have not stopped being targets. Roughly $329 million was attributed to bridge hacks in 2026 as of May that year. This figure moves and should carry its as-of date whenever it is cited.
The practical shift. Auditing the contract is now table stakes and no longer sufficient. The recent failures are in solver infrastructure, admin keys, deployment pipelines and the humans holding credentials. Those are the parts that no audit report covers.
What happens after a bridge is drained?
Recovery is the least-discussed part of the record and the most relevant if you are the one exposed.
- Wormhole users were made whole because Jump Crypto covered the 120,000 ETH. That was a backer's balance-sheet decision, not a protocol mechanism.
- Nomad recovered roughly $36 million of $190 million through a bounty offering white hats a 10% keep.
- Harmony recovered nothing. A $10 million bounty produced no meaningful result.
- Multichain users were still in court years afterwards.
The lesson. There is no reliable recovery mechanism. Whether you are made whole depends on whether someone with a balance sheet decides to make you whole. Design around the assumption that a loss is final.
What can you actually check before depositing?
Six questions, derived from the failure record rather than from theory.
- What is the threshold, and are the signers genuinely independent? Ronin's fifth signature came from a delegation the operator still effectively controlled.
- Is the verification path specifically audited? Audit count is a weak signal. Coverage of the code that checks proofs is the relevant one.
- What happens during an upgrade? Nomad's loss came from a routine upgrade. Ask whether configuration changes are timelocked and reviewed as code.
- Who can mint, and how would you know if they did? On-chain proof of reserves answers this. An attestation asks you to trust a report.
- Is the off-chain layer in audit scope? Solvers, relayers, admin infrastructure. Usually the answer is no, and that is where the recent failures are.
- What is your exposure window? Holding a wrapped representation is an open-ended exposure. Completing a native swap closes it in minutes.
Where does Rift sit in this taxonomy?
Rift is exposed to several of these categories and it is worth being specific about which.
Off-chain coordination and infrastructure. Rift's execution runs in a hardware enclave in a data centre. Compromise of the hardware vendor or the data centre operator is the analogue of the off-chain compromise category, and it is the primary risk.
Dependency inheritance. Rift routes through other venues. A venue compromised while holding funds mid-route loses those funds. Every dependency in the path is inherited.
Code risk. No formal audit has taken place. The code is open source and heavily tested, which is not the same thing.
Upgrade risk, mitigated but present. Upgrades are gated by an Ethereum contract holding the approved image hash, a hardware-key multisig and a seven-day timelock, during which any single uncompromised signer can refund all users. That is a longer and more public window than Nomad had, not an elimination of the category.
Not applicable. Rift settles to native assets and does not issue a wrapped representation, so the minting-authority category does not apply, and the exposure window is the duration of the trade rather than open-ended.
Sources
- Cumulative bridge losses, share of DeFi losses, and root-cause patterns — Spark, "Blockchain Bridge Security Comparison": https://www.spark.money/tools/bridge-security-comparison
- 2022 incident totals and the shift to social engineering and supply-chain attacks — Protos: https://protos.com/bridge-hacks-back-in-vogue-as-verus-exploit-brings-2026-total-to-329m/
- Ronin attack path, Harmony warning period, Nomad upgrade failure — Zircuit: https://www.zircuit.com/blog/the-bridge-hacks-that-exposed-cross-chain-finances-fatal-flaws
- Wormhole
verify_Signaturesflaw and Harmony 2-of-5 threshold — Immunefi: https://medium.com/immunefi/common-cross-chain-bridge-vulnerabilities-d8c161ffaf8f - Ronin and Wormhole loss figures, Nomad ranking — CertiK: https://www.certik.com/blog/cross-chain-vulnerabilities-and-bridge-exploits-in-2022
- Nomad recovery, Wormhole reimbursement, Multichain litigation — HOGE Wire: https://hoge.gg/anatomy-of-a-bridge-hack-crypto-weak-link/
- Off-chain trust logic as the recurring failure point — Shattered: https://shattered.io/coreum-bridge-hack-200k-xrp-2026/
- eBTC minting incident — Phemex: https://phemex.com/academy/ebtc-vs-wbtc-vs-cbbtc-tokenized-bitcoin-comparison
- Garden solver incidents — Crypto.news: https://crypto.news/garden-finance-takes-app-offline-after-independent-solver-database-compromise/
Related: Is a TEE Safer Than a Multisig Bridge? compares the trust models these incidents tested. How to Move Bitcoin to Ethereum covers the exposure window on wrapped representations.