A Bridged Token Is Just an IOU

Cross-chain bridges tie the Web3 ecosystem together. With them, it's possible to lock an asset on one blockchain and unlock a corresponding one on another. This allows Web3 users to take advantage of various chains and the projects hosted on each.

Often, bridged tokens are treated as the same asset but on another chain, but this isn't the case. A bridged token boils down to an IOU from the cross-chain bridge claiming that the user can redeem the bridged token for the original asset on demand.

How Cross-Chain Bridges Work

Cross-chain bridges can be implemented in several different ways (lock and mint, burn and mint, etc.). Since the various Layer-1 chains generally can't talk to one another at a protocol level, bridging an asset often means locking it in a smart contract on the source chain and issuing a parallel asset on the destination chain.

Since the bridged asset has no inherent connection to the original one, redemption depends on the bridge provider. If the provider's custody, keys, or verification fail, then the bridged asset loses value.

When Bridges Fail

In theory, cross-chain bridges work because all bridged assets are fully collateralized. Every minted, bridged token is backed by a locked token that can be released if the bridged asset is redeemed.

In practice, bridges can fail, which can bring their IOUs into question. Three examples include:

• Wormhole (Feb 2022): Wormhole suffered a security incident where a flaw in signature verification allowed an attacker to mint 120,000 wETH with no collateral. The effects of the attack were mitigated by Jump Crypto depositing 120,000 ETH within 24 hours to offset the losses.
• Ronin Network (March 2022): Ronin is one of the most expensive hacks in Web3, where compromised keys for a multisig wallet allowed an attacker to steal an estimated $625 million. The protocol refilled the bridge from its own balance sheet to ensure that it was able to fulfill redemption requests.
• Multichain (July 2023): Approximately $126 million in crypto was drained from Multichain after the CEO, who controlled all the keys, was arrested. Funds deposited in the bridge were unredeemable, and the bridge shut down.

In some cases, bridge users were able to get their money back after an incident due to well-funded backers; however, this isn't a guarantee. The value of bridged assets depends on the security of the bridge itself as well as the underlying asset.

Managing Cross-Chain Risk Exposure

Bridges are critical infrastructure in Web3, but they're also highly centralized and a common target for cybercriminals. The value of a bridged token depends on the bridge provider, including:

• How collateral and keys are held and secured
• How cross-chain messages are verified for deposits and withdrawals
• How redemption is guaranteed in the event of a security incident.

When possible, use native issuance (e.g. USDC and Circle) for cross-chain bridges, where the issuer burns the token on one chain and reissues on another. This reduces cross-chain bridge risk exposure but does introduce centralization risks. When this isn't an option, limit exposure to bridged assets to manage the associated risks.

Educational content, not legal, financial, investment, or professional security advice. Terms