Bridges have caused roughly 40% of everything ever stolen in Web3 — over $2.8 billion since 2022 alone. In May 2026 they were still responsible for 42% of that month's exploit losses, out of a category that holds only a sliver of total DeFi value. Crypto has spent four years promising this problem is getting fixed. The honest answer for 2026 is more complicated than yes or no.
The number that hasn't meaningfully moved
Cross-chain bridges — the infrastructure that locks a token on one blockchain and mints a representation of it on another — have produced more than $2.8 billion in cumulative losses since 2022, roughly 40% of everything ever stolen across Web3. That's not a historical footnote from crypto's wilder early days. In May 2026 alone, bridges accounted for $28.6 million of the month's roughly $70 million in total exploit losses — 42% of the damage, from a category of protocol that holds only a fraction of total DeFi value locked. Bridge TVL sat around $21.94 billion as of March 2026, while monthly bridge flows across major corridors regularly exceed $10 billion. The ratio of "share of losses" to "share of value held" has stayed stubbornly, disproportionately high since the 2022 peak — the years in between haven't closed that gap.
2026's two biggest incidents, and why they're structurally different from 2022's
DeFi losses topped $750 million through mid-April 2026 alone, led by two incidents: a roughly $290 million loss tied to Kelp DAO's LayerZero configuration, and a $285 million theft from Solana-based Drift Protocol on April 1, attributed to North Korean state-linked actors. The Drift incident is worth sitting with specifically because it wasn't a smart contract bug in the traditional sense — it involved a months-long social engineering campaign, with the attackers posing as a legitimate quantitative trading firm and building trust by depositing their own capital before executing the theft. That's a meaningfully different threat model than 2022's headline exploits, which were largely pure code vulnerabilities: the $624 million Ronin hack, the $320 million Wormhole theft, the $190 million Nomad exploit.
Why bridges keep being the target, structurally
Security researchers at Sherlock frame the core problem clearly: cross-chain systems grant authority based on external claims rather than local execution. A message arrives from another chain saying "this user deposited X, credit them Y" — and the bridge has to decide whether to trust it. The dangerous version of that design accepts whatever payload shows up and updates balances immediately. Once a forged or replayed message gets accepted, it often bypasses the ordinary rate limits and multi-step checks that would catch a similar attack anywhere else in a protocol, which is exactly why bridge losses tend to be sudden and total rather than gradual.
Two smaller 2026 incidents illustrate that exact pattern. Hyperbridge was exploited in April after an attacker used a forged cross-chain message to mint one billion fake bridged DOT tokens and sell them into available liquidity — initial losses were reported around $237,000, though a later assessment put realized losses closer to $2.5 million, modest only because liquidity happened to be limited. Verus Protocol's Ethereum bridge lost roughly $11.6 million after a fake cross-chain transfer message tricked it into releasing funds from its own reserves. Different bridges, same underlying failure: a message that shouldn't have been trusted, was.
Where real architectural progress has actually happened
It's not all treadmill. A few genuine structural responses have emerged rather than just incremental patching:
| Approach | What it actually changes |
|---|---|
| Native/official bridges | Built directly by a chain's own team (e.g. Arbitrum Bridge) with strong incentive alignment to secure it well |
| Light client / SPV verification | Verifies the source chain directly rather than trusting a wrapped-token custodian, removing a layer of custodial risk |
| Bridgeless swaps | Atomic cross-chain swaps that avoid the lock-and-mint model entirely, removing the honeypot bridges represent |
| Multi-verifier messaging | Requiring several independent verifiers to agree, rather than trusting a single configuration, before crediting a cross-chain message |
Wormhole is a useful case study on the "still evolving" side of this. After its $320 million 2022 hack, the protocol underwent real security audits and architectural improvements before relaunching — a genuine response, not just a statement. The open question heading into the rest of 2026 is whether it, and protocols like it, can keep balancing throughput and user convenience against the security bar institutional adoption actually demands, especially as the value flowing through these systems keeps climbing.
So — has crypto actually fixed this?
No, not in the sense of the aggregate loss numbers meaningfully improving — 42% of a month's total exploit losses coming from bridges in May 2026 is not a materially better ratio than the industry has posted in prior years. But I don't think "not fixed" and "no progress" are the same claim, and I'd resist collapsing them into one. The failure mode has genuinely shifted: from raw, findable code bugs toward social engineering, configuration mistakes, and forged-message attacks that exploit trust assumptions rather than software flaws. That's arguably a harder problem to fully solve, not an easier one — but it also means the pure "just get better audits" fix that seemed sufficient in 2022 was never going to be the whole answer.
The real structural alternatives — bridgeless swaps, light client verification, multi-verifier designs — represent genuine architectural rethinking rather than the same lock-and-mint model with better paint. They're not yet dominant enough to have moved the aggregate loss numbers, but they're the part of this story worth watching over the next year, more than any single quarter's exploit total.
This piece is informational and general market commentary, not financial or security advice. Bridge risk varies significantly by specific protocol and implementation — do your own research into a bridge's audit history, verifier design, and incident record before moving significant funds through it.