Biggest Bridge Hacks Ranked, With Root Causes

Video transcript

Bridges release pooled funds on a message from another chain. Forge that message, or sign it, and you can take funds nothing backs.

Per DefiLlama, Ronin leads at 624 million dollars, then Poly Network at 611 million and Binance Bridge at 570 million.

The twelve largest total 3.41 billion dollars, 92 percent of all flagged bridge losses.

In our grouping, five broke message or proof checks and five came through keys and signers. One was a software bug, one a verifier setup.

Verification code cost the most. At Nomad, one upgrade made every message valid, and about 190 million dollars left in roughly two and a half hours.

Ronin needed five of nine validator signatures, and Sky Mavis ran four. An Axie DAO allowlist entry, never revoked, gave the fifth. Count independent operators, not keys.

Kelp DAO lost 293 million dollars in April 2026. LayerZero says a lone verifier was fed forged chain data, and Kelp disputes how that setup arose.

After a lull in 2024 and 2025, bridge hacks are back. DefiLlama flags 51 in 2026 so far, worth 753.5 million dollars.

Guardian audits bridge contracts, pentests the infrastructure around them, and maps every key and signer in an OpSec audit. Managed Security monitors contracts on every block.

Read the full ranking, or talk to Guardian about keeping your bridge off this list.

A bridge holds pooled funds on one chain and releases them when told something happened on another.

Whoever can forge that message, or sign it, can take funds that nothing backs. That makes bridges some of the largest single targets in crypto.

We ranked every incident DefiLlama flags as a bridge hack, using its data read November 6, 2026. Root causes come from the teams' own statements, Rekt and news reports.

For how bridges work and how to secure one, see our guide to cross-chain bridge security.

The 12 Largest Bridge Hacks

Together these 12 total $3.41 billion, 92% of all flagged bridge losses. The 13th, AFX Bridge, is $24.15 million.

Loss is DefiLlama's gross figure, before any return. Dates are DefiLlama's, in UTC.

The top amounts match our list of the biggest crypto hacks of all time, built on the same dataset. Where a team or Rekt gives another figure, we name it below.

Four Root Causes

We grouped the 12 by what the attacker had to break. The grouping is ours, from the sources cited.

Message and proof checks

Poly Network. A crafted cross-chain call made Poly's manager contract change the keepers' public keys, Rekt found. It needed "no private key compromise."

The attacker later returned nearly all the funds, CNBC reported.

Binance Bridge. Forged proofs minted 2 million BNB. Rekt quotes samczsun: "a bug in the way that the Binance Bridge verified proofs."

Rekt valued the mint at about $586 million and says about $127 million moved to other chains. BNB Chain said "the vast majority of the funds remain under control."

Wormhole Portal. A fake account let the attacker bypass the check on Wormhole's guardian signatures and mint 120,000 wETH on Solana. The backing was restored in less than 24 hours, per Rekt.

Nomad. A June upgrade set 0x00 as a trusted root, so "all messages were read as valid by default." Copycats reused the first transaction, and about $190 million left in roughly two and a half hours, per Rekt.

Qubit. An old deposit function stayed in QBridge. Called with the zero address as the token, it did not revert, so the bridge credited ETH that was never deposited, Rekt found.

Keys and signers

Ronin. Withdrawals needed 5 of 9 validator signatures. Sky Mavis ran four, and an Axie DAO allowlist entry that was never revoked supplied the fifth, per Rekt.

The theft went unnoticed for six days.

Harmony. The bridge used a 2-of-5 multisig, and two of its keys were compromised. Rekt says the vector is unknown.

Multichain. About $125 million moved out of Multichain's bridge wallets on July 6, 2023, DL News reported. DefiLlama records $126 million.

Multichain said its CEO had been in custody since May 21, and its access keys to the servers hosting its MPC nodes had been revoked.

Heco Bridge. PeckShield flagged $86.6 million in outflows and noted a withdrawal "initiated by the operator," Cointelegraph reported. PeckShield asked whether the operator was compromised.

Orbit Bridge. Rekt says the $81.5 million loss was "initially assumed" to come from compromised signer keys. Orbit's developer, Ozys, later implicated its former CISO.

DefiLlama files Orbit under signature verification flaw.

Verifier setup and infrastructure: Kelp DAO

LayerZero says Kelp's rsETH route used a 1-of-1 verifier setup, with LayerZero Labs as the only verifier. It puts the loss at about $290 million.

Per LayerZero, the attacker poisoned two RPC nodes, then hit the healthy ones with a denial of service. The verifier "confirmed transactions that never in fact took place."

The two sides differ on how the route came to rely on one verifier:

• LayerZero: it and others had shared best practices on verifier diversity with Kelp.
• Kelp: it told CoinDesk the setup "followed LayerZero's documented defaults," and that the compromised stack was LayerZero's own, crypto.news reported.

Both accounts agree that one verifier guarded the route, and that its infrastructure was compromised.

Our LayerZero vs Wormhole comparison covers how each protocol decides a message is real.

Chain software bug: Liquid Network

SideSwap said Blockstream traced about 4,000 unbacked L-BTC to "a bug in the Elements software," The Block reported.

SideSwap's peg-out service burned them, and the Liquid Federation paid out 3,996 BTC. SideSwap's key was used, not compromised.

The attacker returned 3,400 BTC after the patch, The Block reported.

What the Data Shows

• 2022 was the peak. Six of the 12 happened that year, worth $1.89 billion.
• Bridges were half of 2022. Flagged bridge hacks were 52.4% of all losses DefiLlama lists that year.
• Then a lull. Bridge losses were $36.8 million in 2024 and $38.3 million in 2025.
• 2026 is back. 51 flagged incidents worth $753.5 million through November 5.
• The typical one is small. The median bridge hack is $2.1 million; 36 of 100 were under $1 million.
• Gross is not net. Poly Network's and Liquid Network's attackers returned most funds, and Wormhole's backing was restored.

Across the dataset, bridge hacks are 7.6% of entries but 13.4% of losses: $3.69 billion of $27.60 billion.

How We Ranked

• Data: DefiLlama's hacks API, read November 6, 2026. It holds 1,340 entries, the latest dated November 5.
• Selection: every entry with DefiLlama's bridgeHack flag set to true: 102 entries, 100 with an amount.
• Left out: 10 entries in DefiLlama's Bridge & Cross-Chain class without the flag, mostly 51% attacks. The largest is $18 million.
• Ranking: by DefiLlama's recorded amount, in nominal dollars, with no recoveries subtracted.
• Returns: DefiLlama's returnedFunds field is filled for only one of the 12, Wormhole Portal.

Anyone can rebuild the ranking from DefiLlama's public API.

How Guardian Helps

Guardian's smart contract audits review bridge contracts, and its infrastructure pentests test the servers and cloud accounts around them.

An OpSec audit maps every path to your funds: the roles that can move them, and the keys, signers and multisigs behind each one.

Since February 2025, Guardian has verified every step of USDT0's omnichain rollout, including each chain's peers and DVN sets, per our case study.

After launch, Managed Security monitors contracts on every block, including upgrades and large fund movements. It reviews every multisig transaction before it is signed.

Frequently Asked Questions

What is the biggest bridge hack ever?

Ronin Bridge, on March 23, 2022: $624 million in DefiLlama's data. The attacker controlled five of its nine validator signatures: four run by Sky Mavis, plus one through Axie DAO access that was never revoked.

Why do bridges get hacked so often?

They hold pooled funds and act on messages from another chain. Forge a message, break the code that checks it, or control enough signing keys, and the bridge releases funds that nothing backs.

Which bridge hacks happened in 2026?

The two largest are Liquid Network ($320 million, September 6) and Kelp DAO ($293 million, April 18). DefiLlama flags 51 bridge hacks in 2026 through November 5, worth $753.5 million.

Are bridge hack losses net of recoveries?

Not in this ranking. DefiLlama's amounts are gross. Poly Network's attacker returned nearly everything, Wormhole's backing was restored within a day, and Liquid Network's attacker returned 3,400 BTC.

Sources

• DefiLlama: Hacks dataset API (read November 6, 2026)
• Rekt: Ronin Network, Rekt (March 29, 2022)
• Rekt: Poly Network, Rekt (August 11, 2021)
• CNBC: Hacker behind $600 million crypto heist returns final slice of stolen funds (August 23, 2021)
• Rekt: BNB Bridge, Rekt (October 7, 2022)
• BNB Chain: BNB Chain Ecosystem Update (October 7, 2022)
• Rekt: Wormhole, Rekt (February 3, 2022)
• Rekt: Nomad Bridge, Rekt (August 2, 2022)
• Rekt: Qubit, Rekt (January 28, 2022)
• Rekt: Harmony Bridge, Rekt (June 24, 2022)
• Rekt: Multichain, Rekt 2 (July 7, 2023)
• DL News: Crypto bridge Multichain says it's ceasing operations after CEO and sister arrested in China (July 14, 2023)
• Cointelegraph: HECO Chain bridge compromised, over $86.6M sent to suspicious addresses (November 22, 2023)
• Rekt: Orbit Bridge, Rekt (January 3, 2024)
• LayerZero: KelpDAO Incident Statement (April 19, 2026)
• crypto.news: Kelp DAO blames LayerZero defaults for $290M rsETH bridge disaster (April 20, 2026)
• The Block: Liquid Network attacker says they will return most of 4,000 BTC after bug fix (September 7, 2026)
• Cointelegraph: Liquid Network pauses after $320M Bitcoin withdrawal (September 7, 2026)
• Guardian: USDT0 Deployment and Configuration Verification case study
• Guardian: The Biggest Crypto Hacks of All Time, Ranked (November 2026)