The $1 Billion Security Problem Facing Blockchain Bridges
First Wormhole and Axie Infinity, now Nomad: Hackers steal billions by attacking blockchain bridges.
First Wormhole and Axie Infinity, now Nomad: Hackers steal billions by attacking blockchain bridges. That’s why they’re so vulnerable.
Hackers stole nearly $200 million from Project Nomad on Monday, August 1, 2022. And once again, the target of the criminals was the blockchain bridge. The case sheds light on a serious security issue in the industry because so-called bridges are the perfect target for hackers and are increasingly common in the DeFi sector. Experts have been warning about the danger for months. This year alone, more than $1 billion has been stolen this way.
The most high-profile case hit the sector in March 2022: Axie Infinity. Hackers stole $625 million by attacking the bridge of the popular play-to-earn game. That came after Wormhole was hit in February 2022 for $320 million. There are more than 70 DeFi bridges, according to security expert Sebastian Banescu. The reason for their popularity: bridges solve a fundamental problem of blockchains. But at a high price.
A lucrative target for cybercriminals
Popular cryptocurrencies like Bitcoin (BTC) or Ethereum (ETH) are built on independent blockchains with different rules and programming languages. They basically can’t talk to each other directly. That’s exactly where bridges come into play. They enable cross-chain communication using a variety of tricks.
If someone needs to access a service on Solana but only has Ethereum, they can move it into a bridge, receive Solana, and then swap it back at the end. Users lock up their crypto on a blockchain inside a smart contract. Those tokens are then reissued (mined) on another network.
At the same time, bridges offer a lot of attack surface compared with traditional smart contracts on a blockchain. "The complexity of cross-chain interactions creates a very fragile system that’s incredibly hard to protect," says Sebastian Banescu of Quantstamp. "A hacker only needs to find a small hole to steal money."
"Bridges have become an exceptionally lucrative target for cybercriminals because there’s so much money flowing through them," says Adrian Hetman of Immunefi, a leading blockchain security firm. He’s sure we’ll see more of these attacks.
Most troubling is that Vitalik Buterin, the founder of Ethereum, warned in a January 2022 blog post about the security risk bridges pose. In the long run, he argued, they could threaten the entire crypto ecosystem:
''If there are a hundred blockchains with their own dApps and they become dependent on each other through bridges, an attack on one chain could poison the whole system.'' — Vitalik Buterin
A first breakthrough toward solving this problem came recently with Polkadot (DOT), the project led by Ethereum co-founder Gavin Wood. In May 2022, the platform published an update, called XMC, enabling secure and fast cross-chain exchange without bridges, via so-called parachains.
