A bridge does not move an asset between chains. It accepts evidence that an event on one chain entitles someone to release or mint value on another. The exploit surface is that evidence: who can produce it, how it is checked, and which state transition it authorizes.
The familiar bridge-hack label hides distinct failures. Ronin lost control of its signing threshold. Wormhole accepted a forged message. Nomad made an invalid root pass as trusted. Taiko’s 2026 incident began with an exposed prover signing key and an attestation check that accepted a debug-mode enclave. These are not four versions of one smart-contract bug. They are four different failures in the chain of trust.
A Bridge Is an Evidence Pipeline
A typical cross-chain transfer has a source event, a message or proof that attests to it, a verifier on the destination chain, and a release or mint operation. The bridge's security depends on every link. A correct vault cannot rescue a verifier that accepts false evidence; a mathematically sound proof system cannot rescue a compromised key that is allowed to attest to arbitrary computation.
The useful question is therefore not simply whether the bridge contract was audited. It is: what exact assumption lets this message become authoritative? Across these cases, that assumption sat in different places.
1. Ronin: The Threshold Was Smaller Than It Looked
In March 2022, an attacker withdrew 173,600 ETH and 25.5 million USDC from the Ronin bridge, then worth roughly $625 million. The bridge required five of nine validator signatures. The apparent security property was a five-signature threshold. The operational reality was that the attacker obtained control of five keys: four validators operated by Sky Mavis and one Axie DAO validator.
The fifth signature was obtained through an old access arrangement. Sky Mavis had retained authority to sign on behalf of Axie DAO after a gas-free RPC arrangement, and that permission was not revoked. The threshold existed in code, but the keys were concentrated across a small operational perimeter. The failure was key custody and validator independence, not a forged proof.
The lesson is not that multisignature thresholds are useless. It is that a threshold only measures security if the signers are independent in practice. Shared infrastructure, stale permissions, and weak monitoring can turn nine nominal validators into a much smaller trust domain.
2. Wormhole: A Verifier Accepted the Wrong Authority
In February 2022, an attacker exploited Wormhole’s Solana bridge to mint 120,000 wrapped ETH without depositing matching ETH on Ethereum. The defect was in signature verification: a deprecated verification path failed to establish that the supplied sysvar account was the genuine system sysvar. By supplying a forged account, the attacker bypassed the guardian-signature check.
Here, the guardian threshold was not defeated by stealing enough guardian keys. The verifier was asked to validate evidence using an account that was not the trusted source of that evidence. The distinction matters: increasing the number of signers does little if the contract can be induced to read a counterfeit verification context.
3. Nomad: Zero Became an Accepted Root
In August 2022, Nomad lost approximately $190 million after an upgrade initialized a Replica contract with the zero value as its trusted committed root. In that verification design, zero was also the default root for an unproven message. The result was a broken invariant: messages that had not been proven could satisfy the condition intended to distinguish valid messages from invalid ones.
Once the first withdrawals demonstrated that the check passed, other users copied the transaction pattern. The drain became a public race. The critical failure was not a sophisticated cryptographic break. It was an initialization state that collapsed the boundary between ‘not proven’ and ‘trusted.’
Nomad shows why upgrade review must include the state produced by initialization, not only the new implementations' functions. A verifier can be correct in isolation and still fail because its starting state violates the invariant it assumes.
4. Taiko: A Prover Key and a Debug Flag
Taiko’s June 21, 2026 incident is a newer case with a different trust boundary. The attacker used an exposed SGX enclave signing key, committed to a public repository, together with an attestation check that did not reject debug-mode enclaves. The key let an attacker sign an enclave build with an expected signer measurement. Debug mode removed the memory protections that should have constrained what that enclave could do.
That combination let the attacker register rogue prover instances and submit proofs over a fabricated version of Taiko’s L2 state. A separate age check then enabled permissionless proving after a proposal appeared to be more than five days old. Because the attacker could forge the proof data, the proposal age was forgeable too. The whitelist was bypassed through a condition designed to preserve liveness when the approved provers were unavailable.
The accepted fake state was written to the L1 Signal Service, which the bridge then relied on to validate withdrawals. The attacker filed 39 forged withdrawal messages; 36 paid out, for about $1.75 million. Taiko’s first-party postmortem says the proving mathematics and bridge contracts were not themselves broken. The failure was in key custody, enclave attestation, and the assumptions connecting proof submission to permissionless fallback.
Two controls limited the loss: per-asset daily withdrawal limits and an emergency pause. In one early attempt, a 999 ETH claim failed but still consumed almost the day’s ETH allowance. That slowed later ETH withdrawals. Some tokens without effective limits were drained, showing that a safeguard only constrains assets and execution paths to which it actually applies. The bridge was later replenished 1:1, reopened on July 2, and Taiko says affected users were made whole.
The Shared Pattern Is a Broken Invariant
Each incident can be expressed as an invariant that failed:
-
Ronin: enough valid signatures should imply independent authorization. The keys were not independent enough.
-
Wormhole: a signature check should consume only the canonical verification context. The account supplied to the check was not authenticated.
-
Nomad: an unproven message must not match a trusted root. Initialization made the zero root pass.
-
Taiko: only approved, production-attested provers should create accepted state proofs. Exposed signing material and a missing debug-mode check defeated that assumption.
The commonality is not that ‘bridges are unsafe.’ It is that bridges convert evidence into asset movement, so every ambiguity in evidence, authorization, initialization, or fallback becomes a potential withdrawal primitive.
What Bridge Reviews Should Test
A useful review follows the evidence path end to end, including operations and recovery. A security design that ignores the surrounding infrastructure creates an illusion of safety that is easily bypassed.
The broader attack surface
The four incidents fit within a wider bridge threat model. Research on cross-chain bridge security separates failures into permission, logic, event, and front-end issues. The categories matter because a bridge can fail before a message reaches its verifier: a compromised interface can misdirect a user, a false deposit event can fabricate source-chain evidence, or an over-permissive approval can expose tokens without any bridge message being forged.
Permission failures include stolen or over-concentrated keys, as in Ronin. Logic failures include verifier and initialization defects, as in Wormhole and Nomad. Event failures occur when a destination system accepts an event that does not correspond to the required deposit or message. Front-end failures can compromise the path users take to initiate a transfer, even when the contracts themselves behave as written. These distinctions prevent an audit from treating the bridge contract as the whole system.
A 2023 systematization of bridge security identifies 12 potential attack surfaces and documents incidents across these classes. Its historical estimate found bridge attacks accounted for about $2 billion in losses from January through July 2022, or 69% of DeFi attack losses in that period. That figure describes a specific period, not a current cumulative total. The broader point is that bridge risk is distributed across contracts, keys, event interpretation, user interfaces, and operations.
-
Map the trust boundary: identify every key, signer threshold, prover, attestation, root, checkpoint, and external account whose validity gates a release.
-
Test independence, not just thresholds: account for shared operators, cloud infrastructure, emergency permissions, and stale cross-organization access.
-
Treat initialization as security-critical code: verify the deployed state and prove that default values cannot satisfy a success condition.
-
Test fallback paths against adversarial inputs: liveness mechanisms such as permissionless proving can widen access under precisely the conditions an attacker may be able to forge.
-
Model limits per asset and per execution path: check when quotas are consumed, whether failed attempts count, and which assets have no limit.
-
Exercise the emergency process: a pause that depends on slow coordination or an unusable proposal path may arrive after withdrawals begin.
The Bridge Is Only as Strong as Its Evidence
Ronin, Wormhole, Nomad, and Taiko failed at different layers: custody, verification context, initialized state, and prover attestation. That distinction is operationally useful. Each class demands a different control, and adding more contract audits or more signers cannot substitute for controls aimed at the actual trust boundary.
The design target is not a bridge with no assumptions. It is a bridge whose assumptions are explicit, independently enforced, and bounded when one fails. Withdrawal limits and emergency governance can cap damage, but they do not make false evidence true. The lasting security property is that an invalid source-chain state cannot become an authorized destination-chain payout.
Sources: Taiko Labs incident postmortem; Ronin Network’s incident report; Wormhole’s incident report; Nomad’s postmortem.
Support CryptoBug with $CRYPB
Own a stake in independent, no-sponsor Web3 research.