Top Cross Chain Bridge Hacks Of 2022

about 2 years ago

cross chain bridge hacks.png

Cross-chain bridge is a way of connecting two blockchains. They allow you to exchange assets without having to try and use an exchange platform or move through multiple steps in order to get them out of one blockchain and into another.

This is an important tool for crypto investors who want to move their assets around quickly, safely, and easily. It is an emerging technology that is still in development. Bridges allow different blockchains to communicate with each other, opening up the possibility for interoperability between blockchain networks and cross-chain DApps.

In this article, we will look at some of the most bleeding cross-chain bridge exploits that happened in 2022.

Ronin Bridge Hack

On March 23rd, 2022 the biggest crypto hacks happened on Ronin Network which is a side chain to Ethereum. It is used by Axie Infinity, the most popular P2E game at that time. 173,600 ETH & 25.5 million USDC, totaling $650 million, were lost because of that. Ronin bridge had 9 validators out of which signatures of 5 were required to confirm the transactions. The attacker got access to all 5 keys stored in the Sky Mavis (Axie Infinity Developers) servers which were sent back to Axie DAO but they were never deleted originally. 😴

Harmony Bridge Hack

A Harmony Bridge aka Horizon Blockchain bridge was hacked in late June this year and the hacker managed to steal $100m in a variety of crypto assets which were later sold for other cryptos on DEXs. The Harmony Bridge was vulnerable because the hacker needed to access only 2 out of 5 keys required to validate the transactions. Once someone had access to those keypairs, they could initiate transactions on behalf of any user who deposited funds into their account. Because these transactions are irreversible once confirmed by network consensus, there's no way those funds could be recovered. Harmony kept those keys in password management software and the hacker managed to decrypt multiple keys to hack the system.

Nomad Bridge Hack

On the 1st of August, Nomad Bridge which supports over 40 blockchains and has been used for thousands of transactions since its launch in December 2020, was hacked for around $200 million in crypto. Only Ethereum-based assets were attacked due to a connection vulnerability. A message to validate the transaction was failing before approving the transaction and the hacker took this as an opportunity to steal. Thousands of other hackers joined the party later on until the TVL went from $190 million to ZERO. The first hacker dumped all the tokens into Ethereum and cashed out most of it. Over $30 million were returned by hackers but the rest is gone forever.

Wormhole Hack

Wormhole is a cross-chain bridge protocol that allows users to transfer cryptocurrencies and NFTs between the Solana and Ethereum chains. In February, 2022 it was drained of 120,000 wETH (around $320 million) tokens and distributed between the hacker’s Solana and ETH wallets. The hacker found an exploit that allowed them to mint 120k wETH tokens without giving away his own Ethereum locked in the contract during the wrapping of ETH to wETH on Solana. Just after the hack, Solana was dumped heavily. And 120k Ethereum was replenished by Solana Developers as soon as they realized the hack happened. Wormhole also offered a large sum for "bug bounty" to the hackers in exchange for the return of the stolen cryptocurrency.

QBridge Hack

QBridge protocol is an Ethereum to BSC (Binance Smart Chain) bridge that allows users to swap ERC-20 and BEP-20 tokens between the two blockchains.

A user on Chain A wants to send funds (say, $10) to another user on Chain B. The sender sends their $10 transaction to the QBridge contract with an output for “send” and containing the address of the recipient in both chains, along with any other relevant information (such as metadata). The QBridge contract will then send out transactions on both chains in order to transfer those funds from one chain into an account on another chain.

In January 2022, a hacker initiated a deposit transaction via QBridge ETH contract and attached malicious data that passed all of the contract’s checks without depositing Ethereum. This resulted in a loss of $80 million in tokens.

Conclusion

The current state of cross-chain bridges is not a great one. The various hacks that have occurred on these systems have shown the world that even though bridges are essential for the blockchain ecosystem, there's still a lot of work to be done when it comes to security.