Security
Cross-chain bridge incident library
Key findings
This library lists 16 cross-chain bridge security incidents from 2021 to 2026, with reported losses adding up to about $3.27B (each figure is the amount reported at the time by the cited sources, not adjusted for later recoveries). The largest is Ronin Bridge (2022-03-23, 173,600 ETH + 25.5M USDC (≈ $624M)); 4 of 16 were key or signer compromises; 6 happened in 2026, most recently NEAR Intents on 2026-10-01.
- Inclusion rule: a full write-up is published only with ≥300 words of original analysis and ≥2 independent sources; otherwise the incident stays a single row here.
- Losses: USD at the time of the incident as reported by the cited sources; DefiLlama Hacks is used as one source, never the only one.
- Dates: UTC calendar date of the exploit.
Sources are listed on every incident page; base list from DefiLlama Hacks · CC BY 4.0
Which bridge incidents are in the library?
16 incidents, newest first; 15 have a full write-up. Click a column header to sort.
| Date (UTC) | Protocol | Reported loss | Root cause | Recovery | Chains | Page |
|---|---|---|---|---|---|---|
| 2026-10-01 | NEAR IntentsNEAR Intents | $3.8M | Contract bug · a deposit-notification feature kept ledger credit for deposits whose tokens had been refunded, creating unbacked balances | Funds returned | NEAR, BNB Chain, other Omni-connected chains | write-up |
| 2026-09-27 | Fake GIWA bridgeOP Stack Standard Bridge | $2M | Impersonation / phishing · a fake L2 with the expected chain ID and a bridge proxy controlled by a 2-of-2 Safe; the owners swapped the portal code and emptied deposits | Partly recovered | Ethereum, fake GIWA chain (ID 9134) | write-up |
| 2026-09-11 | Symbiosis (BTC bridge)Symbiosis | $336,000 | Verification flaw · the Bitcoin-side decoder read the sender from a part of the deposit data the spender controls, so the attacker posed as an authorised depositor and portal admin, set the minimum fee below zero, and a negative fee that was never sign-checked turned a 330-satoshi deposit into an arbitrary syBTC mint | Partly recovered | BNB Chain, Ethereum, Rootstock, Bitcoin | list only |
| 2026-09-06 | Liquid Network | $320M | Verification flaw · an ambiguous cache key in Elements' rangeproof verification cache let a forged confidential output reuse a cached 'valid' result and inflate L-BTC | Partly recovered | Liquid, Bitcoin | write-up |
| 2026-07-17 | Across Protocol (Solana relayer)Across | $4.5M | Off-chain software · the off-chain relayer did not check Solana's 8-byte Anchor event discriminator, so forged deposit events were treated as real | Users made whole | Solana, 18 destination chains | write-up |
| 2026-04-18 | KelpDAO rsETH bridge (LayerZero)Stargate | $292M | Configuration / trust setup · rsETH used a single required verifier (1-of-1 DVN); attackers poisoned LayerZero Labs' internal RPC nodes and DDoS'd the external one, so the DVN attested a forged Unichain→Ethereum message | Partly recovered | Ethereum, Unichain, Arbitrum | write-up |
| 2024-07-16 | LI.FIJumper (LI.FI) | $11.6M | Token-approval abuse · a newly deployed facet (GasZipFacet) allowed arbitrary calls without the whitelist check used elsewhere, so wallets with infinite approvals were drained | Users made whole | Ethereum, Arbitrum | write-up |
| 2024-01-16 | Socket / BungeeBungee (Socket) | $3.3M | Token-approval abuse · a new route's performAction passed unvalidated swapExtraData into a call, letting the attacker inject transferFrom against users' approvals | Partly recovered | Ethereum | write-up |
| 2023-12-31 | Orbit Bridge | $81.5M | Key compromise · withdrawals were signed by 7 of the 10 multisig signers; Orbit says it was not a contract bug and blames security settings changed by a former executive (unconfirmed) | Not recovered | Ethereum | write-up |
| 2023-07-06 | Multichain | $126M | Key compromise · funds secured by MPC keys effectively controlled by one person; whether the outflows were a hack or insider action is unresolved | Not recovered | Fantom, Moonriver, Dogecoin bridge | write-up |
| 2022-10-06 | BNB Chain BSC Token Hub | $570M | Verification flaw · a bug in the IAVL Merkle-proof verification used by the Token Hub precompile let the attacker forge proofs for two withdrawals of 1M BNB each | Partly recovered | BNB Smart Chain, BNB Beacon Chain | write-up |
| 2022-08-01 | Nomad Bridge | $190M | Verification flaw · a June 2022 upgrade initialised the Replica contract with a zero root marked as trusted, so any unproven message passed verification | Partly recovered | Ethereum, Moonbeam, other Nomad-connected chains | write-up |
| 2022-06-23 | Harmony Horizon Bridge | $100M | Key compromise · attackers compromised at least two of the bridge validators' private keys, enough to approve withdrawals, after phishing a developer and gaining server access | Not recovered | Ethereum, BNB Chain, Harmony | write-up |
| 2022-03-23 | Ronin Bridge | $624M | Key compromise · attackers obtained 5 of the 9 validator signatures: four Sky Mavis keys plus Axie DAO's, via a never-revoked gas-free RPC allowlist | Users made whole | Ethereum, Ronin | write-up |
| 2022-02-02 | WormholeMayan | $326M | Verification flaw · the Solana contract's verify_signatures accepted a fake 'instructions sysvar' account, so guardian signatures were never really checked | Users made whole | Solana, Ethereum | write-up |
| 2021-08-10 | Poly Network | $611M | Verification flaw · the cross-chain manager contract could be made to call the data contract that stores keeper keys, letting the attacker replace the keepers with their own key | Funds returned | Ethereum, BNB Chain, Polygon | write-up |
How are incidents selected and checked?
We start from DefiLlama Hacks entries flagged as bridge incidents, then check the date, loss and root cause against at least one other independent source — preferably the project’s own post-mortem — before writing anything.
- Anything we could not confirm in two independent sources is marked 待核实 on the page, not stated as fact.
- Loss figures are what sources reported at the time; recoveries and repayments are described separately.
- Each write-up links the bridges we review that were involved, and our reviews link back.