Cross-chain bridges have now produced cumulative losses exceeding $2.9 billion, accounting for roughly 40% of all value stolen in Web3 history. In April 2026 alone, two bridge-adjacent exploits — KelpDAO ($292M) and Drift ($285M) — accounted for 92% of the month's $625 million in total crypto hac...
"Attackers compromised nodes and fed the system a false version of reality." — Samczsun, Head of Security Research, Paradigm
Cross-chain bridges have now produced cumulative losses exceeding $2.9 billion, accounting for roughly 40% of all value stolen in Web3 history. In April 2026 alone, two bridge-adjacent exploits — KelpDAO ($292M) and Drift ($285M) — accounted for 92% of the month's $625 million in total crypto hack losses. Both attacks were attributed to North Korea's Lazarus Group, which captured 76% of all stolen crypto value in 2026 through just those two operations, according to TRM Labs.
The failure modes have not changed since 2022. Lock-and-mint architectures concentrate hundreds of millions in honeypot smart contracts. Cross-chain messaging layers rely on single verifiers that can be poisoned. Admin key management remains vulnerable to social engineering. Meanwhile, a structural shift is underway: intent-based protocols (Across, deBridge), native burn-mint standards (Circle CCTP), and oracle-verified messaging (Chainlink CCIP) have collectively processed tens of billions in volume with zero major protocol-level exploits. The market is splitting into two tiers — legacy bridge infrastructure that keeps getting hacked, and newer architectures that have so far avoided systemic failure.
On April 1, 2026, Drift Protocol — a Solana-based perpetual DEX — lost $285 million after a six-month social engineering campaign by North Korea's UNC4736 (TraderTraitor subgroup). The attackers embedded themselves in Drift's ecosystem starting in fall 2025, depositing over $1 million of their own funds, engaging contributors with "detailed and informed product questions," and eventually inducing Security Council multisig signers into pre-signing transactions that carried hidden admin authorizations. The attackers also manufactured a fictitious asset — CarbonVote Token — with seeded liquidity and wash trading. Drift's oracles treated it as legitimate collateral. The full drain executed in 12 minutes, according to The Block.
Seventeen days later, on April 18, KelpDAO's LayerZero bridging adapter was drained of 116,500 rsETH ($292M). The attack vector was different but the outcome identical: attackers compromised RPC nodes used by LayerZero's Decentralized Verifier Network (DVN), launched a simultaneous DDoS attack against external RPC fallbacks, and spoofed cross-chain burn messages. The Ethereum-side contract released the full amount to an attacker-controlled address. LayerZero attributed the exploit to DPRK's Lazarus Group and blamed KelpDAO's 1/1 DVN configuration. KelpDAO countered that LayerZero's default deployment code promoted single-source verification, according to CoinDesk reporting.
The cascading effect was severe. The attacker deposited 89,567 rsETH into Aave as collateral and borrowed $190.86 million in wrapped ETH against it. This triggered $8.45 billion in withdrawals from Aave and over $13 billion from DeFi broadly within 48 hours, per Chainalysis.
Four distinct cross-chain transfer architectures now operate at scale, each with fundamentally different risk profiles:
Lock-and-Mint. Users lock native tokens in a smart contract on the source chain. A bridge protocol mints synthetic wrapped representations on the destination chain. The locked pool is a concentrated, high-value target. Examples: Wormhole (legacy), Multichain (defunct), Ronin Bridge.
Liquidity Pool. Pre-funded pools of native assets sit on each supported chain. No wrapping occurs; users swap into existing pools. Risk concentrates in pool contracts and the cross-chain messaging layer that coordinates rebalancing. Examples: Stargate, Synapse.
Intent-Based. A user declares an intent (e.g., "send 10 ETH from Ethereum to Base"). Competitive solvers fulfill the order using their own capital and are reimbursed after cryptographic proof of delivery. No shared liquidity pool exists on-chain. Examples: Across Protocol, deBridge, Relay.
Native Verification / Burn-Mint. The token issuer itself controls cross-chain movement. Tokens are burned on the source chain and minted natively on the destination chain with issuer attestation. No wrapped tokens, no liquidity pools. Examples: Circle CCTP (USDC), Wormhole NTT (for partner tokens like RLUSD, USDS).
The historical record is unambiguous. Lock-and-mint bridges have produced the largest exploits in Web3: Ronin Bridge ($625M, 2022), Wormhole ($320M, 2022), Nomad ($190M, 2022), Harmony Horizon ($100M, 2022), and now KelpDAO ($292M, 2026). The failure modes are structurally identical across a four-year span: compromise the verification layer — whether validator keys, signature checks, or RPC nodes — and the entire locked pool is accessible.
The KelpDAO attack demonstrated that even protocols built on theoretically decentralized messaging layers remain vulnerable when deployment configurations create single points of failure. KelpDAO's rsETH used a single LayerZero Labs DVN as its sole verifier. No second DVN was required to agree. When the attacker poisoned the RPC nodes that DVN relied on, the entire $292 million pool was exposed.
Wormhole has attempted to address its legacy architecture through Native Token Transfers (NTT), which bypass wrapping entirely. The protocol has also integrated zero-knowledge proof verification from Boundless Labs (powered by RISC Zero zkVM) as an optional trust-minimized security layer. Notable NTT deployments include Ripple's expansion of RLUSD to Base, Optimism, Ink, and Unichain, and Sky Ecosystem's bridging of over $880 million in USDS to Solana. These represent a meaningful architectural improvement, but the transition is incomplete — legacy wrapped assets still constitute significant bridge TVL.
Intent-based protocols represent the most significant architectural departure from traditional bridging. By eliminating shared liquidity pools entirely, they remove the concentrated honeypot that has been exploited repeatedly since 2022.
Across Protocol uses UMA's optimistic oracle for dispute resolution and bonded relayers who front capital to fill user orders. Fill times for USDC transfers between Ethereum and major L2s average 2-15 seconds, per Across documentation. The protocol has processed billions in cumulative volume with no relayer loss events. Its market capitalization stood at $43.5 million as of March 2026 — relatively modest for a protocol handling significant volume, suggesting the market has not yet fully priced in the security advantage.
deBridge operates through its Decentralized Liquidity Network (DLN), where competing solvers scan orders and fulfill them by executing the destination-side trade first. Decentralized validators verify the proof and release input funds only after confirmation. The protocol has processed $2.35 billion in transfer volume from 385,000 unique users and generates approximately $100,000 in daily protocol fees. Its strict 0-TVL design means no liquidity ever sits locked inside deBridge smart contracts. Users receive native tokens — no bridged wrappers that could depeg, no pool imbalance causing hidden slippage.
In February 2026, deBridge launched Model Context Protocol (MCP) integration, enabling AI agents to execute cross-chain swaps programmatically — an early indicator that bridge infrastructure is being embedded into autonomous software pipelines, not just human-facing interfaces.
No intent-based bridge has suffered a major protocol-level exploit through mid-2026. The structural reason is straightforward: there is no large pool to drain. Solver capital is transient, disbursed per-order and reimbursed after verification. An attacker would need to compromise the verification and settlement layer while simultaneously intercepting individual solver transactions — a fundamentally harder problem than draining a static pool.
Circle CCTP represents the issuer-controlled model. USDC is burned on the source chain, Circle's off-chain Iris attestation service signs the burn message, and fresh native USDC is minted on the destination chain. No wrapped tokens. No pools. CCTP V2, launched on Ethereum and Avalanche in March 2025, has expanded to 13+ mainnet chains with 30-second fast finality, programmable post-transfer hooks, and Solana support. The protocol has processed over $140 billion in cumulative volume, with roughly $2.4 billion moved in March 2026 alone, per Circle's CCTP Dune dashboard. CCTP V1 is being phased out by July 31, 2026.
The tradeoff is centralization. Circle is the sole attestation authority. If Circle's Iris infrastructure goes down or is compromised, CCTP transfers halt. This is a fundamentally different risk profile than a smart contract exploit — it is counterparty risk on a regulated financial institution rather than code risk.
Chainlink CCIP operates as oracle-verified messaging infrastructure. The protocol now connects 60+ blockchains and processes $18 billion in monthly cross-chain volume, securing over $28 trillion in cumulative transaction value. Cross-chain transfers via CCIP surged 1,972% to $7.77 billion in 2025, according to Chainlink's year-in-review data.
Institutional adoption is the differentiator. Twelve-plus financial institutions — including Euroclear, Clearstream, ANZ, Citi, BNY Mellon, and BNP Paribas — have used CCIP for cross-chain settlement of tokenized assets. SBI Group (Japan's largest financial conglomerate, $200+ billion in assets) adopted Chainlink as exclusive infrastructure for its digital asset platform. JPMorgan and UBS are running live CCIP settlement trials targeting SWIFT's $150 trillion in annual messaging volume. SWIFT itself enabled 11,500 member banks to attach blockchain wallet addresses to payment messages and settle tokenized assets through existing infrastructure in November 2025.
CCIP has not suffered a major exploit. Its Guardian Network model — with multiple independent attestation layers — is designed to avoid the single-verifier failure that destroyed KelpDAO. The economic question is whether CCIP's fee structure and Chainlink's oracle dependency create a different form of infrastructure concentration risk.
| Architecture | Cumulative Losses (2022-2026) | Largest Single Exploit | Structural Risk | TVL Exposure | |---|---|---|---|---| | Lock-and-Mint | ~$2.0B+ | $625M (Ronin) | Concentrated pool + verification bypass | High | | Liquidity Pool | ~$400M+ | $190M (Nomad) | Pool drainage + messaging compromise | Medium | | Intent-Based | $0 (protocol-level) | N/A | Solver-level, per-transaction | Near-zero | | Native Burn-Mint (CCTP) | $0 | N/A | Issuer counterparty risk | Zero on-chain | | Oracle-Verified (CCIP) | $0 | N/A | Oracle network centralization | Variable |
The data shows a clear hierarchy. Intent-based and native burn-mint architectures have produced zero protocol-level exploits, while lock-and-mint bridges continue to generate nine- and ten-figure losses using failure modes documented since 2022.
This does not mean newer architectures are immune. Intent-based bridges face theoretical liquidity exhaustion attacks (documented in academic research, arXiv: 2602.17805). CCTP carries Circle counterparty risk. CCIP depends on Chainlink's Guardian Network maintaining integrity. But the empirical record through mid-2026 is unambiguous: the highest-loss architecture is lock-and-mint, and the gap is widening.
The cross-chain bridge market is bifurcating. Legacy lock-and-mint infrastructure continues to absorb nine-figure losses using the same failure modes documented since 2022. Newer architectures — intent-based, native burn-mint, and oracle-verified — have collectively processed hundreds of billions in volume without a major protocol-level exploit.
The economic implication is straightforward: protocols, DAOs, and institutions selecting bridge infrastructure face a measurable cost differential between architectural classes. The KelpDAO exploit did not reveal a new vulnerability. It demonstrated that the known vulnerabilities of 2022 remain exploitable in 2026 when deployment configurations fail to implement available mitigations. The Drift exploit showed that even when code is sound, human-layer attacks can circumvent every technical safeguard.
For the market to mature, three things must occur: lock-and-mint architectures must either harden verification to multi-DVN standards or cede volume to structurally safer alternatives; intent-based protocols must prove they can scale to institutional volume without solver concentration; and oracle-verified systems like CCIP must maintain independence from the financial institutions they serve. The data suggests the transition is underway. It is not complete.