Cross-chain bridges security incident review: Involving over $1.9 billion, most have been compensated or recovered.

There are many public chains in the blockchain ecosystem, but due to the concentration of mainstream assets on a few chains, cross-chain bridges have become key infrastructure for connecting different chains. However, cross-chain bridges frequently become targets of hacker attacks due to their management of large amounts of funds. This article reviews the top ten recent security incidents involving cross-chain bridges, with a total amount of over $1.9 billion involved, of which approximately $1.55 billion has been recovered or compensated.

ChainSwap: $8 million loss resolved by reissuing tokens

In July 2021, ChainSwap experienced two attacks in a short period, with the second causing losses of about $8 million, affecting more than 20 projects using its services. The incident was due to the protocol's failure to strictly verify the validity of signatures. ChainSwap and the affected projects compensated holders through snapshots and reissuing tokens.

Poly Network: $610 million stolen, all recovered

In August 2021, Poly Network was attacked, resulting in a loss of approximately $610 million in assets across Ethereum, Binance Smart Chain, and Polygon. The attacker exploited a vulnerability in contract permission management to successfully replace the validator addresses on the target chains. Despite the sophisticated attack methods, the hacker ultimately returned all the funds, and Poly Network even invited them to serve as a security advisor.

Multichain: $6 million affected, partial compensation has been made

In January 2022, Multichain discovered a significant vulnerability affecting multiple tokens. Although the vulnerability has been fixed, approximately $6.04 million in assets were stolen. The reason was a lapse in the contract's verification of user input. Multichain has recovered nearly half of the stolen funds and compensated users who promptly revoked their authorization.

QBridge: $80 million loss, only a small compensation

At the end of January 2022, Qubit’s cross-chain bridge QBridge was attacked, resulting in a loss of approximately $80 million. The attacker exploited a vulnerability in the contract that did not verify the zero address again, minting a large number of tokens out of thin air on BSC. Currently, Qubit is used very little, and most of the stolen funds have still not been compensated.

Meter.io: $4.4 million loss, promises to compensate with future earnings

In February 2022, the Meter Passport cross-chain bridges were attacked due to an "improper trust assumption" in the code, resulting in a loss of $4.4 million. Meter decided to issue a new token, PASS, to compensate users and promised to buy back using future profits, but the buyback has not yet begun.

Ronin: $620 million stolen, fully compensated

In March 2022, Axie Infinity's Ronin chain suffered a significant loss of $620 million. The attacker gained system access through social engineering techniques. Although the stolen funds were not recovered, the developer Sky Mavis raised $150 million through a new round of financing to compensate users.

Wormhole: $326 million loss, compensation has been paid

In February 2022, Wormhole was attacked due to a vulnerability in the Solana end contract verification, resulting in a loss of approximately $326 million. Jump Crypto quickly injected an equivalent amount of funds into Wormhole to ensure the safety of user assets.

EvoDeFi: Estimated losses of over ten million dollars, not yet addressed.

In June 2022, the DEX ValleySwap in the Oasis ecosystem experienced a severe depegging of USDT due to insufficient liquidity from the EvoDeFi cross-chain bridges it utilized. The specific amount of loss is unknown, but it is estimated to be in the tens of millions of dollars. The relevant parties have not provided any solutions, and users have yet to be compensated for their losses.

Horizon: Nearly $100 million in losses, compensation plan is being developed.

In June 2022, Harmony's Horizon cross-chain bridge was attacked, resulting in a loss of approximately $100 million. The founder acknowledged that it might have been due to a private key leak. Currently, Harmony is discussing a reasonable compensation plan with the community.

Nomad: $190 million stolen, some funds may be recovered

In August 2022, Nomad lost $190 million due to a contract upgrade error. The attack affected 1,251 addresses, with ENS addresses accounting for 38% of the total amount. Some white hat hackers have expressed willingness to return the funds, but the specific compensation plan has not yet been determined.

Summary

The frequent security incidents of cross-chain bridges remind us to remain vigilant. Even cross-chain bridges with high liquidity rankings have experienced security issues. In contrast, projects with strong backgrounds are more capable of recovering assets or providing compensation when handling security incidents. Real-time monitoring and rapid response are crucial for preventing attacks, as Hop Protocol and StarGate have successfully thwarted potential attacks. Users should be cautious when selecting cross-chain bridges and prioritize projects with strong capabilities to reduce risks.