TL;DR

Cross-chain bridges alone have been hacked for $2.5–2.8B+, accounting for roughly 40–70% of all value stolen in some recent years.
Most losses trace back to three patterns: broken key/validator assumptions, fragile message verification, and poor limits on what a single cross-chain message can do.
L2 rollups have fewer public blow-ups so far, but carry concentrated risks in upgrade keys, sequencer control, withdrawal censorship and bridge logic between L1 and L2.
If you are building in Web3, your “cross-chain surface” needs its own threat model and its own audit, separate from local contract logic.

1. Where the money actually goes missing

If you look at Web3 headlines over the last few years, one pattern keeps coming back: the biggest single losses cluster around value in motion, not value at rest.

Poly Network, Ronin, Wormhole, Nomad, Harmony, BSC Token Hub, bridge components in L2 ecosystems all of them sat in the path between chains, tokens, and environments. The more chains we connect and the more value we route through bridges and L2s, the more that path looks like the narrowest point in the funnel where attackers can do the most damage.

The numbers are no longer anecdotal.

By mid-2022, Chainalysis estimated that roughly $2B had already been stolen across 13 cross-chain bridge hacks, representing about 69% of all crypto stolen that year so far. CertiK’s review of the same period pointed to five major bridge exploits totalling about $1.317B, or 57% of all Web3 losses in 2022 at that time.

Elliptic’s DeFi crime report later put 2022 bridge losses over $1.85B, nearly 70% of all crypto theft that year. A 2025 cross-chain security overview from Chainlink estimated that, cumulatively, bridges have now been hacked for over $2.8B, around 40% of all value hacked in Web3, while Hacken’s analysis of DeFi losses attributes more than half of total DeFi value lost to bridge incidents.

Different sources, same story: cross-chain components are routinely where the largest cheques get written.

Rollups and L2s sit in that same family. They are not “bridges” in the narrow sense, but they are cross-domain systems that ship messages and value across trust boundaries. They inherit many of the same failure modes, plus their own (sequencer control, data availability and upgrade authority).

If you are designing, deploying, or integrating any of this, you cannot treat it as a neutral plumbing detail. Cross-chain is the part of your stack where mistakes are multiplied by every chain, every token and every protocol that relies on you.

2. Why bridges keep exploding: three recurring failure modes

Across the big bridge hacks, the specific bugs differ, but the shape of the failures is surprisingly consistent. Most disasters combine some mix of:

Broken key or validator assumptions
Fragile message verification
Unlimited trust in a single cross-chain message

Let’s look at those without re-telling every incident in full.

2.1 Key and validator compromise

Ronin is the canonical example. In March 2022, attackers obtained control of five of nine validator keys on the Ronin sidechain bridge used by Axie Infinity and approved two withdrawals totalling around 173,600 ETH and 25.5M USDC (roughly $540–620M depending on the reference).

Nothing “went wrong” at the Solidity level. The system did exactly what it was told to do. The problem was that the design allowed a small validator set, concentrated under one organisation’s control, to unilaterally approve nine-figure withdrawals once those keys were phished, malwared, or socially engineered.

You see the same theme in other bridges: multi-sig wallets where all signers sit in one company, MPC clusters administered as if they were one HSM, emergency upgrade keys that can swap out critical logic in a single transaction.

The technical lesson is simple: if a handful of keys or validators can move your entire TVL, then key management and validator security are your protocol. Everything else is details.

2.2 Message verification that trusts the wrong things

Wormhole sits here. On the Solana side, Wormhole had to verify that a message (VAA) was genuinely signed by its guardians before minting wrapped assets. A subtle bug in how it used a deprecated Solana helper (load_instruction_at) to infer a prior Secp256k1 verification let an attacker spoof the context and trick the program into accepting a forged guardian message.

Once that check passed, the bridge minted 120,000 wETH on Solana roughly $320M at the time backed by nothing.

Nomad, in a very different way, showed the same “trusting the wrong thing” failure. A botched upgrade effectively turned every valid message into a template that anyone could replay with their own address as the recipient. Attackers didn’t need to break signatures; they only needed to copy-paste a transaction that had already been marked as valid. That collective exploit drained around $190M in a matter of hours.

In both cases, the bridge logic was not just checking signatures; it was loading context from the chain and making assumptions about what that context meant. Those assumptions broke under adversarial pressure.

2.3 Unlimited power per message

The third failure mode is design, not syntax.

Many bridges are built around a simple idea:

function execute(bytes calldata vaa) external {
    VerifiedMessage memory m = verifyAndDecode(vaa);
    _executeMessage(m);
}

If _executeMessage can:

mint arbitrary amounts of wrapped assets
transfer arbitrary amounts of locked assets
change owners or parameters

then the system is effectively saying: “a single VAA is allowed to do anything.”

That is fine if message verification is flawless and key assumptions never break. In practice, they do, and when they do, the damage is limited only by how much the contract allows one message to do in a single shot.

The design lesson is not “bridges are evil.” It is “bridges must be opinionated about blast radius.” Hard limits on per-message minting, daily caps, multi-step flows for owner changes, circuit breakers for abnormal flows these are the things that turn a bug into a contained incident instead of the headline of the year.

3. Rollups and L2s: fewer headlines, heavy assumptions

So far, L2 rollups have not produced as many spectacular public blow-ups as bridges, but that is more luck and hard work than an inherent guarantee of safety.

The ingredients for large losses are absolutely there.

3.1 Critical bugs that never made it to mainnet… this time

In early 2022, a researcher disclosed a critical issue in Optimism’s rollup implementation that would have allowed an attacker to effectively “replicate money” on any chain using a modified version of their client.

The bug was responsibly reported and patched; funds were not stolen. But the takeaway is that L2 validity and fraud logic is complex enough that a single missed check can have bridge-scale impact.

In a separate 2022 incident, Hacken describes a vulnerability in Optimism that led to a loss of around $31.5M, again highlighting how sequencer and bridge components can become attractive targets in L2 ecosystems.

The absence of more “Ronin-sized” L2 hacks should not be read as proof that they cannot happen. It may simply be that the right vulnerability being left unpatched long enough has not happened yet.

3.2 Upgrade keys, sequencer control and withdrawal risk

A recent “ethical risk” analysis of rollups surveyed 129 L2 projects and found that about 86% supported effectively instant upgrades with no enforced exit window for users, and around half had control structures that could freeze or heavily delay withdrawals.

From a user’s perspective, those are not theoretical details. They are concrete answers to questions like:

Can the team push a breaking change today that affects my ability to exit tomorrow
Is there a forced-inclusion path if the sequencer decides to ignore my transactions
How long do I have to get out if something looks wrong on the L2

These are cross-domain questions. They live exactly at the boundary between L1 guarantees and L2 promises. They are also, in many cases, still under-documented and under-tested.

3.3 The hidden bridge in every rollup

Every L2 has a bridge, usually several: the canonical bridge between L1 and L2, and sometimes application-level bridges that wrap specific tokens.

Even if the core rollup logic is sound, mistakes in message encoding, replay protection, or permission checks at this bridge layer can open the same kind of holes we have seen in classic cross-chain bridges. The difference is that the L2 brand and liquidity may make the target even more attractive.

The lesson: treating an L2 as “just Ethereum but cheaper” and ignoring its cross-chain assumptions is a category error. Its bridge and exit logic deserve the same level of paranoia as any standalone bridge product.

4. A practical lens for builders and teams

You cannot fix the entire cross-chain ecosystem alone. But you can stop your protocol from being an easy part of the attack surface.

A useful way to think about it is to separate three questions.

4.1 What are we depending on cross-chain?

Make a list that fits on a single page: the external bridges you use, the L2s you deploy to, and any cross-domain message buses or custodians in the middle. For each, write down:

who holds upgrade keys
who controls sequencers or validators
what the emergency exit looks like if something goes wrong

This is not paperwork. It is the start of a threat model.

4.2 What can a single cross-chain message do to us?

Look at your own contracts and integrations. For each entrypoint that processes a cross-chain message, ask:

can this function mint or move unbounded value
can it change owners, guardians, or critical parameters
how do we know the message is fresh and not replayed
what stops this from being called again and again in the same block

You do not need to make these invulnerable in one step. But you do need to know where the sharp edges are.

Even a small refactor like splitting “view-only” messages from “state-changing” ones, or adding hard caps to cross-chain minting, dramatically reduces your worst-case loss.

4.3 How are we validating the critical paths?

Finally, decide which parts of your cross-chain surface get independent, adversarial review.

This is where audits come in. You want at least one serious pass focused solely on:

bridge contracts and gateways
message verification and decoding
admin and upgrade paths
interactions with external bridges and L2 canonical contracts

Ideally this happens before you route real TVL through them. If you are already in production, it still matters especially if you are about to scale the amount of value or the number of chains you touch.

5. Where Exploitless fits in this picture

Exploitless focuses on one core thing: security audits for Web3 smart contracts and protocols.

Cross-chain surfaces bridges, message buses, L2 gateways, and protocols that depend on them are exactly where we like to spend our paranoia.

When we audit, we do not stop at local contract bugs. We map trust boundaries:

which keys, validators or sequencers your protocol implicitly trusts
which contracts can mint, burn or unlock assets based on cross-chain messages
how messages are verified, replay-protected and limited in scope
how badly a single failure in an external bridge or rollup could hurt you

The goal is not to prove that “bridges are safe now.” It is to make sure your system does not become the next nine-figure lesson in how cross-chain can go wrong.

If you are building or upgrading anything that moves value across chains and want that level of scrutiny, that is exactly the work we do at Exploitless.

Learn More at Exploitless

References

Chainalysis 2022 cross-chain bridge hacks analysis: ~13 bridge hacks, about $2B stolen, roughly 69% of all crypto stolen that year to date.
CertiK cross-chain vulnerabilities review: five major bridge hacks in 2022 totalling $1.317B, around 57% of all Web3 losses at the time.
Elliptic DeFi crime trends: over $1.85B stolen from bridges in 2022, nearly 70% of all theft that year, plus breakdown of key incidents like Nomad, Ronin and others.
Chainlink cross-chain vulnerabilities overview: bridges hacked for more than $2.8B in total, representing almost 40% of all value hacked in Web3, with discussion of core bridge weakness patterns.
Hacken cross-chain and L2 security analysis: bridge hacks representing more than 50% of DeFi value lost, and a notable 2022 Optimism L2 incident with ~$31.5M drained via sequencer-related vulnerability.
“Ethical Risk Analysis of L2 Rollups” survey of 129 rollup projects showing ~86% with effectively instant upgrades and about half with mechanisms that can freeze or delay withdrawals, plus broader discussion of L2 trust assumptions.
Saurik’s write-up on an Optimism critical bug description of a now-patched exploit path that could have allowed replicating funds across chains via the rollup’s client.

Bridges, Rollups, L2s: Why Cross-Chain Is Still Where Money Goes Missing