Biggest Crypto Bridge Hacks: What Went Wrong (2026)

In April 2026, one forged message moved about $290 million. Nobody cracked any encryption and nobody guessed a password. A cross-chain bridge got a message saying "release the funds," the message looked valid, and the bridge paid out. That was the KelpDAO incident, the largest hack of 2026 so far, and it fits a pattern that runs through almost every one of the biggest crypto bridge hacks since 2021.

If you're new to crypto, bridges can feel like plumbing you never have to think about. They are also where some of the industry's biggest losses have happened. This guide explains what a bridge is in plain language, lists the largest exploits with their documented causes, and gives you a short checklist for judging whether a bridge is worth trusting.

Cross-chain bridges lost roughly $2 billion across 13 separate hacks by August 2022, according to Chainalysis.PeckShield counted eight significant bridge incidents with about $329 million in combined losses in 2026 through mid-May, as reported by KuCoin.The KelpDAO rsETH exploit of April 18–19, 2026 (about $290–293 million) involved a bridge setup that relied on a single verifier, per 1inch's summary of the public dispute.Most major bridge hacks in this list trace back to one of four root causes: stolen keys, verification bugs, weak configuration, or accounting gaps.None of the hacks listed here broke the underlying cryptography. The failures were in key management, configuration, and proof-handling code.

Table of Contents

• What Is a Crypto Bridge, in Plain English?
• Bridge Hacks List: The Biggest Crypto Bridge Hacks of All Time
• Which Bridge Hacks Happened in 2026?
• Why Do Cross-Chain Bridge Exploits Keep Happening?
• What Does a Trustless Bridge Design Actually Change?
• Are Crypto Bridges Safe? A 6-Question Checklist
• Frequently Asked Questions
• Conclusion

What Is a Crypto Bridge, in Plain English?

A crypto bridge is a system that lets you move value from one blockchain to another, such as from Bitcoin to Ethereum. Blockchains can't read each other's records. Ethereum has no built-in way to see that you sent BTC on Bitcoin, so a bridge has to carry that information across and act on it.

Think of a coat check. You hand over your coat (you lock your coins on Chain A) and get a ticket (a "wrapped" token on Chain B). The ticket is only worth something because the coat is still in the cloakroom. When you want the coat back, you hand in the ticket and the attendant gives you the coat.

Bridge hacks follow from that picture. An attacker has two main options:

• Forge tickets. Trick the bridge into issuing wrapped tokens with no coat behind them, or into handing over coats for fake tickets.
• Steal the master key. Take control of whoever is allowed to say "this ticket is valid" and empty the cloakroom.

In both cases, everyone holding real tickets is left with IOUs that aren't fully backed anymore. That's why one bridge exploit can hurt thousands of people who never interacted with the attacker.

Two terms will come up throughout. A validator (or signer) is a party whose approval the bridge needs before it releases funds. A multisig is a setup where a certain number of those signers, say 5 of 9, must agree before anything moves.

Bridge Hacks List: The Biggest Crypto Bridge Hacks of All Time

The largest bridge hack on record is Ronin (March 2022, about $625 million), followed by Poly Network, BNB Chain's token bridge, and Wormhole. The figures below come from public post-mortems and the Rekt News leaderboard. USD values are at the time of each attack.

What happened in the Ronin hack?

Ronin needed 5 of 9 validators to approve a withdrawal. Four of those keys belonged to one company, Sky Mavis. Months earlier, a fifth validator had temporarily allowed Sky Mavis to sign on its behalf, and that permission was never revoked.

Once the attacker got into Sky Mavis's systems, they had all five signatures they needed. The theft went unnoticed for about six days. The FBI has publicly attributed the Harmony Horizon theft to North Korea's Lazarus Group, and made the same attribution for Ronin in April 2022.

The lesson: nine signers on paper meant far fewer independent signers in practice.

What happened in the Wormhole and Nomad hacks?

Neither one involved stolen keys. In Wormhole, the code that was meant to check guardian signatures could be pointed at a fake input, so the attacker minted 120,000 wrapped ETH with nothing locked behind it. In Nomad, a routine upgrade accidentally made the bridge treat every message as proven. Once one person found it, others copied the transaction and swapped in their own address. It turned into a free-for-all.

Which Bridge Hacks Happened in 2026?

The biggest bridge hack of 2026 is KelpDAO's rsETH exploit in April, at roughly $290–293 million, which accounts for about 89% of the year's bridge losses through mid-May. PeckShield data cited by KuCoin's 2026 bridge exploit roundup put the cumulative total at about $329 million across eight incidents by then. Several more followed over the summer.

The summer figures come from CoinTracking's July 2026 incident tracker. Wanchain was also reportedly drained on July 21, but third-party analysis of its cause (signature reuse) hasn't been confirmed by a final post-mortem, so we've left it out of the table.

What went wrong with KelpDAO?

KelpDAO's rsETH token moved between chains on LayerZero's messaging system. That system lets each app choose how many independent "DVNs" (Decentralized Verifier Networks) have to confirm a message. Kelp's setup reportedly used just one.

An attacker got a forged message accepted, and about 116,500 rsETH, roughly 18% of circulating supply, was released in a single transaction, per KuCoin. LayerZero blamed Kelp's configuration, and Kelp disputed that. The disagreement was still unresolved in public reporting.

The damage then spread. The attacker reportedly used the stolen rsETH as collateral on lending markets including Aave, Compound, and Euler, and borrowed an estimated $236 million, according to Shattered (a single-source estimate). Aave froze rsETH markets to limit bad debt. When other apps accept a bridged token as collateral, a hole in the bridge becomes their problem too.

Why does the Syscoin hack matter?

Syscoin is the 2026 incident beginners most often skip, and it's the most instructive one. Security firm Halborn's analysis found the attacker didn't forge a valid cryptographic proof. They sent a malformed one built to exploit a parsing error in the relay code.

The relay read it as proof of a burn that never happened and authorized a mint. Halborn compares it to Nomad: the cryptography held, and the code around it failed.

Why Do Cross-Chain Bridge Exploits Keep Happening?

Cross-chain bridge exploits keep happening because bridges hold large pools of locked funds behind a small number of checks, so breaking one check pays off hugely. Looking across the incidents above, we sort the causes into four buckets. It's a useful way to think about any bridge you're considering.

1. Stolen keys. The attacker takes over enough signers to approve a fake withdrawal. Examples: Ronin, Harmony, AFX Trade, IoTeX. This is an operational-security failure. The code can be perfect and still be drained.
2. Verification bugs. The code that checks "did this really happen on the other chain?" accepts something false. Examples: Wormhole, BNB Chain, Nomad, Poly Network, Syscoin.
3. Weak configuration. The system could have been safe, but it was set up with too few independent checkers. Examples: KelpDAO's single verifier, Harmony's 2-of-5 multisig.
4. Accounting gaps. Funds are released without checking that matching reserves exist. Example: the July 2026 Verus incident.

The weak link in these incidents is people and plumbing, not math. None of the attacks above broke SHA-256 or Bitcoin's signature scheme.

That shifts the security question away from "is the cryptography strong?" and toward "who or what decides that a cross-chain message is real, and how many separate things have to fail before money moves?"

What Does a Trustless Bridge Design Actually Change?

A trustless (or trust-minimized) bridge replaces "trust these signers" with "verify the other chain's own proof," which takes the stolen-keys and weak-configuration buckets off the table but leaves verification bugs. That trade-off is worth spelling out, and it's especially relevant for Bitcoin.

Most wrapped Bitcoin on other chains comes from one of a few models:

For a deeper look at the custodial side of this table, see our WBTC bridge custody risk vs trustless bitcoin bridges guide.

An SPV (Simplified Payment Verification) light client is a small program on the destination chain that tracks Bitcoin block headers and checks a cryptographic proof that a given transaction is actually in a Bitcoin block. You don't need to take anyone's word that a deposit happened, because the destination chain checks the proof itself.

TeleSwap works this way. It mints TeleBTC, a 1:1 collateral-backed representation of BTC, only after the light client has verified the Bitcoin transaction. Custody is collateral-backed and slashable, and nothing is minted without a verified Bitcoin transaction, so there is no multisig committee approving mints.

According to TeleSwap network stats, the protocol has processed $529.8M in total volume across 561,288 bridge transactions on 13 supported networks.

The trade-off is real. Syscoin is a warning for every proof-based bridge, including light-client ones. A light client protects you from forged signatures and stolen keys, but it's only as good as the code that reads the proof.

Halborn's lesson applies to the whole category: test proof-parsing logic as hard as you test the cryptography. When you evaluate a light-client bridge, look for audits that specifically cover proof parsing and edge cases, not just the token contract.

Are Crypto Bridges Safe? A 6-Question Checklist

Crypto bridges are only as safe as their weakest verification step, so no bridge is risk-free, but some designs are much harder to drain than others. Before you send funds across any bridge, ask these six questions:

1. Who approves a withdrawal? A company, a group of signers, or a cryptographic proof checked on-chain? Fewer humans in the approval path means fewer keys to steal.
2. How many truly independent checks are there? Ronin's "5 of 9" was effectively controlled by one company. KelpDAO had a single verifier. Count independent parties, not headline numbers.
3. Who can upgrade the contracts? A small admin key that can change the code is itself a master key. Nomad's bug came in through an upgrade.
4. Were the configuration and proof-handling code audited, not just the token contract? As the 1inch 2026 review points out, auditing a protocol doesn't help if the deployment is set up badly.
5. Is there a public incident history? Look for published post-mortems and how quickly problems were disclosed. A team that hides problems is a red flag.
6. How long will you hold the wrapped token? A wrapped token carries the bridge's risk for as long as you hold it. Many users bridge, use the funds, and redeem to the native asset instead of leaving large balances wrapped indefinitely.

A practical tip: when you can, swap straight into a native asset on the destination chain instead of holding a wrapped token for a long time. If you're holding wrapped BTC, our unwrap WBTC to native Bitcoin fee comparison covers the cost of getting back to native BTC.

Going from BTC to native ETH on Ethereum, for example, means the bridge's risk applies during the transfer, not for as long as you keep the asset. For a step-by-step version, see our trustless BTC swap guide.

Also watch what your wrapped token is used for elsewhere. The KelpDAO case showed that when a bridged token is widely accepted as collateral, one bridge failure can freeze lending markets you never thought of as related.

Frequently Asked Questions

What is the biggest crypto bridge hack ever?

The biggest crypto bridge hack ever is the Ronin bridge exploit of March 2022, at roughly $625 million. The attacker gained control of 5 of the 9 validator keys needed to approve withdrawals, and the theft went unnoticed for about six days.

What was the biggest bridge hack of 2026?

The biggest bridge hack of 2026 is the KelpDAO rsETH exploit on April 18–19, with losses of about $290–293 million. A forged cross-chain message was accepted by a setup that relied on a single verifier, releasing about 116,500 rsETH in one transaction.

Why are crypto bridges hacked so often?

Crypto bridges are hacked often because they hold large pools of locked funds that are protected by a small number of checks. Breaking one of those checks, whether by stealing signer keys, exploiting a verification bug, or taking advantage of a weak configuration, can unlock the whole pool.

Are crypto bridges safe to use in 2026?

Crypto bridges can be used more safely in 2026 if you choose designs with fewer single points of failure and limit how long you hold wrapped tokens. No bridge is risk-free. Bridges that verify the source chain's proofs on-chain take away the stolen-key risk, but they still depend on correct verification code.

What is the difference between a trusted and a trustless bridge?

A trusted bridge depends on people or companies to approve transfers, while a trustless bridge depends on cryptographic proofs checked by code. Trusted bridges fail when keys are stolen. Trust-minimized bridges, such as SPV light-client designs, fail mainly when the proof-checking code has bugs.

Can stolen funds from bridge hacks be recovered?

Stolen bridge funds are sometimes partly recovered, but often they aren't. Poly Network's attacker returned most of the funds in 2021, and Syscoin coordinated with exchanges and partners to freeze minted tokens in 2026. In many other cases, the assets moved quickly through other channels before anyone could act.

Conclusion

Across Ronin's $625 million in 2022 and KelpDAO's roughly $290 million in 2026, the biggest crypto bridge hacks have the same story: nobody broke the cryptography. The failures came from too few independent checks, keys that could be stolen, or code that read a proof wrong.

Three things to keep in mind: count independent verifiers rather than headline numbers, prefer designs that check proofs over designs that rely on signers, and remember that even proof-based bridges need their parsing code tested thoroughly. If you move Bitcoin between chains, read the TeleSwap docs to see how a trust-minimized Bitcoin bridge checks deposits before minting anything.