Cross-chain Bridge Thefts Top $1B in 2022

As investment in cryptocurrency grows, so does the incentive for criminal actors to exploit the DeFi (decentralized finance) space. Cross-chain bridge hacks have been the weapon of choice for crypto thieves in 2022. Bridge hacks have accounted for more than a billion dollars in stolen funds this year, according to research from blockchain analytics and compliance firm Elliptic.

Cross-chain bridges allow assets to be moved between different blockchain protocols, meaning the networks contain a large concentration of crypto assets. The recent string of bridge attacks has caused some industry leaders to question whether the benefits of bridges outweigh their risks. A top analyst at Elliptic believes bridge hacks are just growing pains that DeFi will eventually surmount.

Harmony, Sky Mavis, and Wormhole all suffered blockchain exploits exceeding $100 million this year. Mudit Gupta, Chief Information Security Officer at Polygon, believes bridge insecurity is an industry-wide problem.

“Most of the hacks are happening due to companies not having proper security experts and not knowing what to do themselves,” Gupta said in a Twitter DM. “There are very few DeFi companies with [dedicated] security personnel.”

DeFi protocols have proliferated rapidly in the past six years, but security infrastructure has not kept up with the now over-$900 billion industry. For this reason, hacks totaling in the hundreds of millions are not surprising. 

On April 1, a trader tweeted their concern that a major Harmony Horizon Bridge exploit would only require a hacker to obtain two of the protocol’s five validator keys. In June, that exact scenario occurred — and Harmony was ransacked for $100 million.

Loading Tweet..

Vitalik Buterin, co-founder of Ethereum, believes cross-chain bridges are inherently prone to security breaches.

“The fundamental security limits of bridges are actually a key reason why…I am pessimistic about cross-chain applications,” Buterin wrote in a lengthy January Reddit post. The influential founder went on to express his belief that assets should be held in the same blockchain ecosystem, rather than shuffled between chains.

Tara Annison, Head of Technical Crypto Advisory at the crypto research firm Elliptic, disagrees.

“We’re not going to live in a single chain world,” Annison said. It will always be necessary to move assets between blockchains, so “we shouldn’t characterize bridges in general as bad just because some have been hacked.”

Annison believes bridge hacks are caused by the concentration of value within cross-chain bridges, not by the bridges themselves.

“If you think of wars, you try to bomb bridges to stop goods and services moving across,” Annison said. Recent cross-chain bridge hacks are not happening “because bridges are inherently weak infrastructure, it’s because they have a concentration of value.”

Annison believes that all crypto assets come with risk, and bridges are just the risk “flavor of the month” following stablecoins in May and NFTs before that. Bridges should become more secure as protocols become more technologically mature.

It remains to be seen if market participants agree.

Sky Mavis’ Ronin Bridge, which was compromised for $625 million in April, reopened this morning. Close to $9 million in assets have already left the chain, according to Messari.

---

Get the news in your inbox. Explore Blockworks newsletters:

• Blockworks Daily: The newsletter that helps thousands of investors understand crypto and the markets, by Byron Gilliam.
• Empire: Start your day with top crypto insights from David Canellis and Katherine Ross.
• Forward Guidance: Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin.
• 0xResearch: Get alpha directly in your inbox — market highlights, charts, degen trade ideas, governance updates, and more.
• Lightspeed: All things Solana, in your inbox, every day from Jack Kubinec and Jeff Albus.
• The Drop: The newsletter for crypto collectors and traders, covering games, tokens, apps, memes and more.