If you use DeFi on multiple blockchains, sooner or later you need to move funds from one chain to another. Bridges are the infrastructure connecting Ethereum with its L2s (Arbitrum, Base, Optimism), with Solana, with Cosmos, with all major networks. Without bridges, each blockchain would be an island.
The problem is that bridges are also the most vulnerable point of DeFi: bridge hacks have generated over $2.5 billion in historical losses. This guide explains how they work, what types exist, which are safest in 2026, and how to use them minimizing risk — or avoiding them entirely when alternatives exist.
What a cross-chain bridge is
This article is part of our complete series on DeFi. If you're new to the topic, start with the pillar guide: DeFi for Beginners: What Decentralized Finance Is and How to Start.
A bridge is a protocol that allows transferring tokens from one blockchain to another. Since each blockchain is an independent system with its own accounting, you can't simply "send ETH" from Ethereum to Solana — those two systems don't recognize each other natively.
The conceptual mechanism almost all bridges use is: lock the original tokens on the source chain and mint an equivalent representation on the destination chain. When you want to return, the process reverses: you burn the representation on the destination chain and unlock the originals on the source chain.
Types of bridges
Three main architectures with different risk profiles:
Lock & Mint bridges
The classic. They lock your tokens in a contract on chain A and mint a "wrapped" version on chain B. The best-known example is wBTC (Wrapped Bitcoin), which is Bitcoin "locked" custodied by BitGo and minted as ERC-20 on Ethereum to be usable in DeFi.
Main risk: if the custody contract or issuer fail, wrapped tokens lose their backing and crash to zero, even though the originals remain intact on the source chain for the attackers.
Liquidity Pool bridges
They use liquidity pools on both chains. They don't "lock and mint" — they simply take your tokens from chain A's pool and give you equivalent tokens from chain B's pool (provided by another user). Faster and no wrapping required.
Main risk: if pools empty or get exploited, transfers get stuck or pay terrible prices.
Native bridges
Protocols built directly into the chains, maintained by official teams. Example: Arbitrum's official bridge for moving ETH between Ethereum mainnet and Arbitrum. They're the safest because they inherit part of the underlying chain's security, but tend to be slow (Arbitrum takes 7 days for withdrawals to guarantee optimistic rollup security).
The safest bridges in 2026
For Ethereum ↔ L2s
- Arbitrum official bridge: safest for ETH → Arbitrum, but Arbitrum → Ethereum withdrawals take 7 days due to optimistic rollup challenge period.
- Base official bridge: ETH → Base direct, same model (7-day withdrawal).
- Across Protocol: third-party bridge with good track record, fast (seconds), L2 → L1 withdrawals in hours instead of days.
- Hop Protocol: specific for L2 ↔ L2 (Arbitrum ↔ Optimism, for example).
For non-EVM chains
- Stargate (LayerZero): leading multi-chain liquidity bridge, presence on 15+ chains.
- Wormhole: connects Ethereum, Solana, Sui, Aptos and others. Had a historic $320M hack in 2022 but has improved significantly since.
- deBridge: newer alternative with good security profile.
The simpler and often safer alternative
For many cases, the best alternative to a bridge isn't any bridge — it's using a centralized exchange as intermediary. Buy the token on Binance, Coinbase or OKX, withdraw directly to the destination network (major CEX support native withdrawals to Arbitrum, Base, Optimism, Solana, etc.) and you save yourself all the smart contract risk of the bridge.
Typical cost: exchange fixed fee ($1-5) + destination network fee (cents). Faster and safer than most bridges for average users.
Bridge risks
Why they're hackers' favorite target: they aggregate custody of many assets from many users in a single contract. If you find a bug, you don't steal from one person — you steal from everyone who trusted their capital to the bridge.
Worst hacks history:
- Ronin Bridge (March 2022): $624 million stolen via compromised validator private keys.
- Wormhole (February 2022): $320 million via message validation bug.
- Nomad (August 2022): $190 million via bug that let anyone withdraw without proving deposit.
- Harmony Horizon (June 2022): $100 million via key compromise.
- BNB Chain Bridge (October 2022): $570 million via merkle proof verification error.
The consistent lesson: the bridge is the weakest link in any multi-chain DeFi strategy. Treat it as such.
Specific risks to consider:
- Smart contract risk: any bug can drain the entire bridge.
- Wrapping risk: if the bridge fails, your wrapped tokens lose backing and become useless even if the originals stay in custody.
- Oracle / validator risk: many bridges depend on a set of validators that sign transfers. If that set is compromised, the bridge empties.
- Fake bridge phishing: there are replicas with similar URLs that directly steal whatever you send.
How to bridge safely
Practical checklist when you have no alternative to the bridge:
- Always use official bridges of the chains when possible. The official Arbitrum or Base bridge is objectively safer than third parties for that same trip.
- Verify the URL character by character. Fake bridges with nearly identical domains are a common scam.
- Start with small amounts to test. Before sending $5,000, send $50 to confirm it arrives and understand the flow.
- Use Rabby Wallet — its transaction simulation shows you exactly what will happen before signing, and it detects bridges with known malicious domains.
- For large amounts (>$5,000), use a centralized exchange as intermediary. Saves time and reduces risk massively.
- Custody on Ledger before and after the bridge. The bridge transaction should be signed from hardware wallet.
- Don't leave wrapped tokens on minor bridges indefinitely. If you'll hold long-term, return to the native asset on the native chain.
Common mistakes that cost money
- Bridging between two L2s via Ethereum mainnet: inefficient and expensive. If going from Arbitrum to Base, use a direct L2-L2 bridge (Across, Hop) instead of "bridging" via Ethereum.
- Trusting unaudited bridges with large amounts: potential fee savings don't compensate principal loss risk.
- Not verifying destination address: especially important when the bridge requires you to manually paste destination address on another chain.
- Assuming "wrapped" is 100% equivalent to native: wBTC is not BTC. If the custodian bridge fails, wBTC is worth what BitGo's bankruptcy estate is worth, not $60,000.
Conclusion
Bridges are essential infrastructure for operating multi-chain DeFi, but also one of the ecosystem's most vulnerable points. For most users, the practical rule is simple: always prioritize security over convenience.
For almost everything that isn't very specific operations between L2s, the alternative of using a centralized exchange as intermediary is safer, often faster, and sometimes even cheaper than the direct bridge. Reserve bridges for cases where there's no alternative, use official ones when you can, test with small amounts first, and treat each bridge operation with the respect owed to the chain's weakest link.
