Bridges and Cross-Chain Technology: Models, Risks, and Operational Procedures.

Operational guide. Updated February 15, 2026.

Cross-chain bridges lost more than $2 billion in hacks between 2021 and 2024. Yet they remain necessary infrastructure for those operating in a multi-chain ecosystem: moving ETH from Ethereum to Arbitrum, bringing BTC to Solana, using Polygon assets on Base. Understanding how they work and where they break is essential before using them.

How a bridge works: lock-and-mint vs liquidity pool

The fundamental mechanism of a bridge is to solve a structural problem: blockchains do not communicate with each other natively. An asset on Ethereum cannot “move” on Solana — it can only be represented on Solana by a synthetic token that attests to its existence elsewhere.

Lock-and-mint

In the lock-and-mint model, tokens are locked to a contract on the source chain and equivalent “wrapped” tokens are mined on the destination chain. When you want to return, the wrapped tokens are burned and the original tokens unlocked. The critical point is the contract that holds the blocked tokens: it is a billion-dollar honeypot, typically controlled by a multisig. Ronin Bridge (Axie Infinity) was emptied for $625 million in 2022 because 5 of the 9 keys to the multisig were compromised by the attacker.

Liquidity pool bridge

Bridges based on liquidity pools (Across, Stargate, Connext) use a different approach: instead of mining synthetic tokens, they move native liquidity between pools on different chains. A relayer provides funds on the destination chain upfront and is reimbursed by the originating chain. The advantage is that the token received is native, not wrapped. The disadvantage is the dependence on the liquidity available in the pools: under conditions of stress, liquidity may be insufficient.

Native interoperability: IBC and CCIP

The IBC (Inter-Blockchain Communication) protocol of the Cosmos ecosystem is the case of interoperability closest to native: it is a standardized protocol at the consensus level, not an additional contract. The smart contract risk is therefore lower, but only applies in the Cosmos ecosystem. Chainlink CCIP is an attempt to bring a similar standard to chain EVM, with validation by Chainlink operators. As of February 2026 it is still relatively new.

The Hack Framework: Why Bridges Are So Vulnerable

Bridges concentrate risk in an extreme way: a single contract (or multisig) can hold billions of dollars of assets locked up by thousands of users. The main hacks exploited different vulnerabilities:

The common pattern: multisig with few keys, operational centralization, and complex contracts with a lot of attack surface. All the hacks mentioned above were avoidable with a different security architecture.

Evaluate the security of a bridge before using it

Not all bridges have the same risk profile. Questions to ask:

Who controls multisig?

Check how many signatures are required, who the signatories are and whether their identities are verifiable. A 2/5 multisig with anonymous signatories is structurally much riskier than an 8/12 multisig with identifiable institutions and public audits. Look for this information in the project’s technical documentation, not in marketing.

Is the contract audited and verified?

An audit does not eliminate risk, but it significantly reduces the likelihood of classic bugs. Check that the code on the chain matches the one audited (Etherscan shows if a contract is “verified”). Check that the audit is recent and from a recognized signature (Trail of Bits, Spearbit, OpenZeppelin, Halborn).

Is there an active bug bounty?

Serious protocols maintain bug bounties on Immunefi or similar platforms. A bridge worth billions without bug bounties is a bad sign: it means that no one has an economic interest in finding the bugs before the attackers.

Safe operating procedure for using a bridge

1. Check the bridge URL: Phishing bridges are common. Use only URLs from official sources (protocol site, link in whitepaper). Don’t click links from DM, Twitter or Discord.
2. Check the contract address: Compare the contract address with the one published in the official documentation on GitHub or Docs.
3. Head with a small amount: before you bridge $50k, test with $100. Verify that the asset arrives on time and in the correct quantity.
4. Check the total fees: include gas on both chains, any bridge fees and slippage. The actual total cost may be significantly higher than the nominal fee.
5. Note forward and return hash tx: in case of problems (bridging stuck), the support will request both hashes. Without this data, recovery is nearly impossible.
6. Do not use bridge during high congestion: transactions stuck mid-bridge (assets that have left chain A but have not yet arrived on chain B) are a source of stress. Use during periods of low congestion to reduce the risk of timeouts.

Most used bridges in 2026: summary comparison

For moves to/from Ethereum mainnet to L2, the native bridges of the L2s themselves (Arbitrum, OP, zkSync) are generally the safest path, although slower for withdrawal. For quick travel without the challenge period, Across and Stargate are the most used options in February 2026.

Practical case: bridging from Ethereum to Arbitrum

To make the operational indications concrete, here is the step-by-step path to bring ETH from Ethereum mainnet to Arbitrum One, using the native bridge.

1. Connect to the official Arbitrum Bridge: go to bridge.arbitrum.io — always check that the URL is correct. The official site never asks for seed phrase or private key.
2. Connect the wallet: use MetaMask or equivalent. The interface automatically detects if you are on the Ethereum network.
3. Select amount: enter the amount of ETH to bridge. Take into account Ethereum gas fees for your deposit transaction — check Etherscan Gas Tracker for the optimal time.
4. Make the deposit: signs the transaction. The transaction is included in an Ethereum block (1-5 minutes). Wait for confirmation.
5. Wait for credit on Arbitrum: after confirmation on Ethereum, ETH appears on Arbitrum usually within 10-15 minutes. In some cases it can take up to 30 minutes during load periods.
6. Check on Arbiscan: Please check your address on arbiscan.io to confirm receipt. The amount received should be identical to the amount sent minus the deposit gas fees.

For withdrawal (Arbitrum → Ethereum), the process is reversed but requires the 7-day challenge period. If you need ETH on Ethereum quickly, instead use a third-party bridge like Across Protocol that advances the funds to the destination chain and gets refunded later — typically in 2-5 minutes.

How to deal with a blocked bridge

A “stuck” bridging — the transaction left chain A but the asset did not arrive on chain B — is one of the most stressful scenarios. It often resolves itself with some time, but sometimes requires intervention.

First thing to do: wait

Most bridges have a timeout of 30-60 minutes before the transaction has finally failed. Do nothing in the first few hours — the system often resolves itself. Check the status of the transaction on the origin chain explorer (is the deposit confirmed?) and on the destination chain explorer (has the credit arrived?).

If the transaction is confirmed on chain A but not arrived on chain B

Most bridges have a “manual claim” function: go to the bridge interface, search for “pending transactions” or “claim”, and you can manually request credit using the hash of the deposit transaction. On Arbitrum Bridge, the “Transactions” section shows the pending and allows manual claiming.

Contact support

If manual claiming doesn’t work, the next step is official bridge support — again via verified channels (official Discord, not DM). You will need: hash of the deposit transaction, source and destination addresses, source and destination chains, amount and timestamp. Without this data, recovery is impossible. Serious bridges have support teams that can manually unblock legitimate transactions that are blocked due to technical issues.

The evolution towards native interoperability

The model of additional bridges — separate contracts that act as intermediaries between existing chains — is a compromise solution. The direction of the industry is towards native interoperability, where chains communicate directly at the protocol level without external intermediaries.

IBC (Inter-Blockchain Communication) in the Cosmos ecosystem it is the most mature model of native interoperability. Any chain that implements the IBC standard can communicate directly with any other IBC chain without additional bridge contracts. The result is a significantly more secure and faster bridging experience — but it only works within the Cosmos ecosystem, not with Ethereum.

Polkadot XCMP offers a similar model within the Polkadot ecosystem: parachains communicate via Cross-Chain Message Passing guaranteed by the relay chain. Safe but limited to the ecosystem.

LayerZero and Wormholes they try to bring cross-ecosystem interoperability (between Ethereum, Solana, Cosmos, etc.) while maintaining adequate security. As of February 2026, both have suffered significant incidents in the past but have rebuilt their security architecture. Confidence is based on the track record of the last 12-18 months.

The long-term vision — one signature, assets available everywhere without friction — is still a long way off. In 2026, for important operations, the advice is to use native L2 bridges or, for speed, protocols with a long security track record and active bug bounties. The complexity of cross-chain interoperability will remain a source of risk for years.

Total bridging costs: realistic calculation

The apparent cost of a bridge — the fee shown in the interface — is often only a portion of the total cost. Understanding the full cost is necessary to evaluate whether bridging makes economic sense for the operation you are planning.

Components of the total cost

Gas on the source chain: the deposit transaction requires gas. On Ethereum mainnet, under normal conditions it costs $5-20; in congestion it can exceed $50. On L2 (Arbitrum, OP) gas is irrelevant ($0.01-0.10).

Bridge Fee: the protocol retains a percentage of the amount as a fee. Across Protocol: 0.05-0.15% variable. Stargate: 0.1-0.06% depending on tier. Arbitrum/OP native bridges: no protocol fees.

Slippage for bridges with liquidity pools: On pools with limited depth, bridging large amounts can cause significant slippage. Check the pool depth for the pair you want to bridge before executing.

Gas on the destination chain (where applicable): some bridges require a claim transaction on the destination chain, with additional gas.

Practical example: bridging $10,000 USDC from Ethereum to Arbitrum via Across Protocol costs approximately: $10 gas on Ethereum + $15 fee Across (0.15%) = $25 total, equal to 0.25%. Instead, using the native Arbitrum bridge (slow, 7 days for withdrawal in the opposite direction) costs only the deposit gas (~$10) without protocol fees.

When not to use a bridge

Not every cross-chain transfer requires a bridge. In some situations, safer or cheaper alternatives exist.

If you just want to move from exchange to different chain: many exchanges allow withdrawals directly to the desired chain. Instead of withdrawing USDC to Ethereum and then bridging to Polygon, withdraw USDC directly to Polygon from the exchange — eliminates the bridge step entirely.

If the amount is small and the fee is disproportionate: bridging $100 with $25 in total costs makes no sense. Wait to aggregate a larger amount or use chains where gas costs are already low.

If you are only bridging for a short-term opportunity: consider the round-trip cost. If you have to bridge back and forth to capture an opportunity, the bridging costs must be less than the opportunity itself — not just the one-way cost.

Check the reliability of a bridge before using it

Before transferring funds through a bridge, it is essential to perform minimal due diligence. The criteria to evaluate are clear: presence of a recent security audit (ideally from Trail of Bits, Zellic or OpenZeppelin), current TVL above $50 million as an indicator of market confidence, history of incidents and team response time in case of bugs, and an active bug bounty program on platforms like Immunefi.

A bridge without a public audit represents an unacceptable risk regardless of the promised return. The $320 million lost on the Wormhole bridge in 2022 and the $625 million on the Ronin Bridge were both systems operating for months without vulnerabilities identified by independent audits. The difference between a secure bridge and an insecure one is often not visible on the surface: it is hidden in the code of validation contracts.

For large transfers, a prudent strategy is to split your capital into multiple smaller transactions instead of transferring everything at once, reducing the risk of total loss in the event of an exploit.

Conclusion

Bridges are necessary infrastructure in a multi-chain ecosystem, but they carry concentrated risk that has no equivalent in other DeFi sectors. The main rule is to proportion the bridged amount to the solidity of the bridge used: for significant amounts, only use native L2 bridges or protocols with a long security track record. Always test with small amounts. Document everything. And never rush.

Related reading: Bitcoin Market Cycles: The Complete Guide to Every Phase · On-chain analysis: a guide to understanding the crypto market.