TL;DR: A crypto bridge moves value between two separate blockchains that cannot talk to each other directly. Most bridges work by locking or burning your asset on the source chain, then minting or releasing an equivalent asset on the destination chain. Native (canonical) bridges are run by the chain itself and are the safest default; third-party bridges like Wormhole trade some of that security for speed and wider chain coverage. Bridges have lost billions of dollars to hacks since 2021, including the $620 million Ronin breach and the $320 million Wormhole exploit, because they concentrate huge amounts of locked value behind a small number of contracts or validators. Before you bridge any amount, confirm the contract address from the project's own documentation, check the fee and wait time, and know whether you are receiving a wrapped asset.
KEY TAKEAWAYS
- A crypto bridge lets you move assets or data between two blockchains that otherwise have no native way to communicate.
- Three common designs exist: lock-and-mint, burn-and-release, and liquidity pool (atomic swap) bridges, each with different trust and speed trade-offs.
- Native (canonical) bridges inherit the security of the underlying chain but are usually slower; third-party bridges are faster but add their own validator or oracle risk.
- Bridge hacks are the single largest category of crypto theft on record, including Ronin ($620M, March 2022), Wormhole ($320M, February 2022), and Nomad ($190M, August 2022).
- Always verify the bridge contract address from official documentation, check wait times and fees, and revoke token approvals you no longer need.
If you have ever tried to move ETH to a Layer 2, send USDC to Solana, or get a token onto a new chain like Robinhood Chain, you have used a crypto bridge, whether you noticed it or not. Blockchains are isolated by design: Ethereum cannot read Solana's state, and Arbitrum cannot natively see what happened on Polygon. A bridge is the piece of infrastructure that closes that gap, and understanding how it works is the difference between a routine transfer and losing funds to a forgotten token approval or a contract address you never checked.
What a Crypto Bridge Actually Does
At its core, a crypto bridge takes an asset or a piece of data on one blockchain (the source chain) and makes an equivalent version available on another blockchain (the destination chain). Since the two chains cannot verify each other's transactions directly, a bridge needs some mechanism to prove that the original asset is accounted for before it releases anything on the other side. In practice, that mechanism takes one of three common forms.
Lock-and-mint. Your original tokens are locked in a smart contract on the source chain. The bridge then mints a new, equivalent "wrapped" token on the destination chain, backed 1:1 by the locked tokens. Wrapped Bitcoin (WBTC) and most Wormhole-wrapped assets work this way. If you later want your original asset back, you send the wrapped token back to be burned, and the bridge unlocks the original.
Burn-and-release. Instead of locking tokens indefinitely, the bridge burns (permanently destroys) the tokens on the source chain and releases an equivalent amount from a reserve on the destination chain. This is common for bridging a token back to its native chain, or between two chains that both recognize the same canonical token standard.
Liquidity pool (atomic swap) model. Rather than locking and minting, the bridge maintains liquidity pools of the same asset on both chains. You deposit on one side, and a relayer or solver pays you out from the pool on the other side almost immediately, later rebalancing the pools in the background. This is how fast "intent-based" bridges like Across and Relay operate, trading a small fee for near-instant finality instead of waiting on the source chain's own confirmation time.
Main Bridge Types: Native vs. Third-Party
Beyond the mechanism, bridges also differ in who operates them and how much trust that requires from you.
A native (or canonical) bridge is built and operated by the team behind the destination chain itself, most commonly for Ethereum Layer 2 networks. Arbitrum's bridge and Optimism's bridge are canonical examples: they are trustless in the sense that they do not rely on a separate set of validators, inheriting their security directly from Ethereum. The trade-off is speed, particularly for withdrawals back to Ethereum, which typically require a multi-day fraud-proof challenge period.
A third-party bridge is an independent protocol that connects many chains that are not natively related, such as Ethereum and Solana, or Ethereum and Cosmos-based chains. Wormhole is the best-known example, alongside LayerZero, Chainlink's CCIP, and intent-based bridges like Across and Relay. These bridges typically rely on a set of external validators, oracles, or "guardians" who watch both chains and authorize transfers. That flexibility is also exactly why third-party bridges have historically been the biggest targets for attackers: compromise the validator set or the message-verification logic, and you can potentially mint assets that were never backed by a real deposit.
| Bridge type | Who secures it | Typical speed | Best for |
|---|---|---|---|
| Native / canonical (e.g., Arbitrum bridge) | The underlying chain's own fraud-proof or validity-proof system | Deposit: minutes. Withdrawal: days (challenge period) | Moving ETH or ERC-20s to/from the chain's own Layer 2 |
| Message-passing bridge (e.g., Wormhole, LayerZero, Chainlink CCIP) | External validator set, guardians, or oracle network | Minutes, depending on source-chain finality | Moving tokens between unrelated chains (e.g., Ethereum ↔ Solana) |
| Intent-based / liquidity bridge (e.g., Across, Relay) | Solver liquidity plus the underlying canonical bridge for settlement | Seconds | Fast transfers where speed matters more than protocol minimalism |
Why Bridges Get Hacked
Cross-chain bridges concentrate enormous amounts of locked value behind a comparatively small set of contracts, keys, or validators, which makes them one of the most attractive targets in crypto. According to blockchain analytics firm Chainalysis, cross-chain bridge exploits accounted for roughly $2 billion in stolen crypto across 13 separate incidents by mid-2022 alone, representing about 69% of all funds stolen that year. Three cases illustrate the main failure modes.
Ronin Network, March 23, 2022 — compromised validator keys. According to the U.S. Department of the Treasury, the Lazarus Group, a North Korea-linked state-sponsored hacking group, carried out what was at the time the largest crypto theft on record, stealing approximately $620 million in Ether and USDC. Ronin's bridge used a Proof-of-Authority set of nine validators, requiring signatures from just five of them to approve withdrawals. Four validators were operated directly by Sky Mavis, the game studio behind Axie Infinity, meaning one more compromised signature handed over control of the whole bridge. According to Rekt News' incident writeup, which cites Ronin's own community alert, the attacker also used a gas-free RPC whitelist permission that Sky Mavis had granted itself through the Axie DAO back in late 2021 and never revoked, supplying the fifth signature needed. With five signatures in hand, the attacker authorized two fraudulent withdrawals, draining 173,600 ETH and 25.5 million USDC from the Ronin bridge contract. The breach went undetected for roughly six days until a user reported being unable to withdraw funds. This was a governance and key-management failure, not a bug in the bridge's code.
Wormhole, February 2, 2022 — a forged signature. Per Wormhole's own incident report, an attacker exploited a signature-verification flaw in the Solana-side contract of the Wormhole bridge, tricking it into minting 120,000 Wormhole-wrapped ETH that were never backed by real ETH collateral. The attacker then redeemed 93,750 of those wrapped tokens for genuine ETH on Ethereum, a theft reported at roughly $320 million at the time. Wormhole's contributors detected the imbalance during a routine check about 43 minutes later, paused the network, and patched the contract; the total incident lasted approximately 16 hours before service resumed. Jump Crypto, a major backer, recapitalized the bridge so all wrapped ETH remained fully backed.
Nomad, August 1, 2022 — a broken default value. According to Nomad's own root-cause analysis, the bridge's Replica contract had been initialized with an empty (zero) root marked as already confirmed. Because any message that had never been proven also maps to that same zero root, the contract treated any message, including completely fabricated ones, as pre-approved. Once the first attacker noticed this, the exploit became trivially easy to copy: anyone could duplicate the original transaction calldata, resubmit it, and drain funds. Security firm CertiK and Rekt News both put the resulting loss at approximately $190 million, drained in under three hours by what effectively became a crowd of opportunistic attackers rather than a single sophisticated actor.
The common thread across all three: bridges fail either because the keys or validators that authorize transfers are compromised (Ronin), because the code that verifies those authorizations has a flaw (Wormhole), or because an upgrade quietly weakens a check that was supposed to prevent forged messages (Nomad). None of this means every bridge is unsafe, but it is why due diligence before bridging matters more than with a same-chain transaction.
Checklist Before You Bridge
A few minutes of verification before you bridge any meaningful amount can prevent the most common and most costly mistakes.
- Confirm the official contract address. Only use the bridge link or contract address published on the project's own documentation or verified app, never a link from a DM, a search ad, or a comment section. Bookmark the official URL rather than searching for it each time.
- Check the fee structure. Canonical L1-to-L2 bridges typically charge just network gas, while third-party and intent-based bridges often add a protocol fee on top. Compare the total cost, not just the headline gas estimate.
- Know the wait time and finality. Deposits into a Layer 2 are usually fast, but withdrawals back to Ethereum through a canonical bridge like Arbitrum's can take roughly 7 days because of the fraud-proof challenge period. Faster third-party routes exist, but they add a different kind of trust assumption.
- Understand what you're receiving. A "wrapped" token (like a bridged USDC variant) is a claim on the original asset backed by the bridge's reserves, not the original asset itself. Check whether the destination app accepts the specific wrapped version you will receive.
- Revoke unused approvals. Many bridge interfaces ask you to approve a contract to spend your tokens before transferring them. Periodically review and revoke approvals you no longer need using a tool like Etherscan's Token Approval Checker, especially for bridges you used once and no longer interact with.
Example: Bridging to Robinhood Chain
Robinhood Chain is a permissionless, Ethereum-compatible Layer 2 built on Arbitrum's technology stack, as we covered in our explainer on what Robinhood Chain is and how it works. Because it is an Arbitrum Dedicated Blockchain, moving assets onto it follows the same canonical-bridge pattern as any other Arbitrum chain, plus a set of faster third-party routes for specific assets.
According to Robinhood Chain's official bridging documentation, the canonical path is the Arbitrum bridge interface, configured for Robinhood Chain as the destination network. Depositing ETH or ERC-20 tokens from Ethereum typically confirms within about 10 minutes; withdrawing back to Ethereum takes about 7 days because of Arbitrum's standard fraud-proof challenge period. For faster transfers, the documentation lists several third-party routes, including LayerZero's OFT standard and Stargate for omnichain token transfers, Chainlink's CCIP via Transporter, and intent-based bridges Relay and Across, which can settle in seconds.
A basic bridging flow to any Arbitrum-based chain, including Robinhood Chain, looks like this: connect your wallet to the official bridge interface, select Ethereum as the source and the destination chain, choose the asset and amount, confirm the gas cost, and submit. The deposit uses Arbitrum's retryable ticket system, so even if the Layer 2 side of the transaction fails (for example, due to insufficient gas), the funds are not lost and can be manually redeemed from the bridge interface within 7 days.
Kommunitas is migrating its own infrastructure from BNB Chain to Robinhood Chain for its next phase of IKOs; the details of that specific migration, including the 1:1 KOM swap and settlement currency changes, are covered separately in our migration announcement and do not require using the general-purpose bridge described above.
Frequently Asked Questions
What is a crypto bridge in simple terms?
A crypto bridge is a protocol that lets you move a token or piece of data from one blockchain to another, since blockchains cannot natively read each other's state. It usually works by locking or burning your asset on the original chain and releasing or minting an equivalent asset on the destination chain.
Is a crypto bridge the same as a wallet?
No. A wallet like MetaMask holds your keys and signs transactions on one or more chains; see our guide on why a single wallet still needs to support more than one blockchain. A bridge is a separate piece of infrastructure you interact with through your wallet to actually move value between chains.
Are wrapped tokens the same as the original asset?
No. A wrapped token (such as bridged WETH or a bridged stablecoin) is an IOU issued by the bridge, backed by the original asset locked on the source chain. Its value should track the original 1:1, but if the bridge is compromised or under-collateralized, the wrapped token can lose that backing.
Why did the Ronin, Wormhole, and Nomad bridges lose so much money?
Each failed differently: Ronin's validator keys were compromised (March 2022, ~$620M), Wormhole had a signature-verification bug in its Solana contract (February 2022, ~$320M), and Nomad's contract initialization accidentally approved forged messages by default (August 2022, ~$190M). All three had large amounts of locked collateral behind a relatively small set of contracts or signers.
How do I add a new network to my wallet before bridging to it?
Most EVM-compatible chains, including Robinhood Chain, can be added to MetaMask either automatically through the official project's "add network" button or manually using the RPC URL, chain ID, and currency symbol from the project's documentation. Our complete guide to adding any network to MetaMask covers both methods and the mistakes to avoid.
Can a crypto bridge transaction be reversed if something goes wrong?
Generally no. Once a bridge transaction is confirmed on the source chain and the destination side has released or minted the corresponding asset, it cannot be reversed. If a deposit stalls on the destination chain due to a technical issue like insufficient gas, some canonical bridges allow you to manually retry the transaction within a set window, but a transaction sent to the wrong address or contract is not recoverable.
Conclusion
A crypto bridge is simply the connective tissue between two blockchains that would otherwise have no way to talk to each other, built around locking, minting, burning, or pooling assets so that value can move across the gap. The mechanism matters less than who secures it: native bridges trade speed for Ethereum-grade security, while third-party bridges trade some of that security for speed and wider chain coverage. Billions of dollars in losses from Ronin, Wormhole, and Nomad show what happens when the validators, signatures, or default settings behind a bridge fail. None of that means bridges are unsafe to use; it means treating every bridge transaction with the same care you would use for any large, irreversible transfer: verify the contract address, understand the fee and wait time, know what you're receiving, and clean up approvals you don't need anymore.
References
- U.S. Department of the Treasury, press release on OFAC sanctions related to the Ronin Network heist, home.treasury.gov
- Wormhole, "Wormhole Incident Report — 02/02/22," official Wormhole Medium publication
- Nomad, "Nomad Bridge Hack: Root Cause Analysis," official Nomad Medium publication, August 5, 2022
- CertiK, "Nomad Bridge Exploit Incident Analysis," August 1, 2022
- Rekt News, "Nomad - Rekt," incident writeup
- Chainalysis, "Vulnerabilities in Cross-chain Bridge Protocols Emerge as Top Security Risk," August 2, 2022
- Robinhood Chain official documentation, docs.robinhood.com/chain/bridging
This article is for educational purposes only and is not financial advice. Cross-chain bridges carry smart contract and custody risk; only bridge amounts you can afford to have delayed or, in a worst case, lost, and always verify contract addresses through each project's official documentation before transacting.