Skip to main content

Explaining crypto’s billion-dollar bridge problem

Illustration by Alex Castro / The Verge

What are blockchain bridges, why do they keep getting hacked, and can we ever stop it from happening?

On March 23rd, the Ronin blockchain network underlying the popular NFT-driven game Axie Infinity was hit with a hack that saw the attackers walk away with an eye-popping $625 million in cryptocurrency.

The Ronin hack was the largest amount of money that had ever been stolen from the type of service called a “bridge,” which connects one blockchain to another so that value can be sent between them. Unfortunately, it was far from the only hack to hit a bridge: less than two months previously, another bridge platform called Wormhole was exploited for close to $325 million, and about six months before that, more than $600 million was stolen from another cross-chain bridge called Poly. (In a surprising twist, the hacker later returned Poly’s stolen funds.)

In short, bridges are the weak point in a lot of cryptocurrency systems, and hackers are targeting them for more than $1 billion in little over a year. So it’s worth laying out exactly what they are, why they’re important, and how crypto companies can try to plug the billion-dollar hole in their pockets.

If you don’t have time to read further, the short answer to the first part is “yes, they’re vulnerable but maybe less so over time.” For the second part, the story is more complex.

(We’re assuming you know what a blockchain is already; if not, you can start here.)

So what is a “blockchain bridge”?

Essentially, it’s a system for connecting different blockchains, allowing users to exchange one kind of coin or token for another. Every cryptocurrency runs on its own blockchain: there’s Bitcoin, Ethereum, and newer currencies like Tether, Ripple, Solana, and so on. There’s no simple way for these different blockchains to interact — they might all use the concept of “addresses” to send and receive currency transactions, but you can’t send ETH directly to a Solana address.

A blockchain bridge is what developers have built to make that crossover a little smoother. If you’re holding ETH and you need Solana’s SOL to sign up for a game, you can send your ETH into a bridge, get SOL in return, and use the same method to convert back when you’re done playing.

Why are bridges particularly vulnerable to hacks?

The short answer is that they’re handling a lot of complex requests and holding a lot of currency — and unlike the blockchains themselves, there’s no standard for how they’re supposed to keep everything secure.

Picture a blockchain bridge as an actual bridge between two islands. Each island has different rules about the type of car you can drive (maybe there’s an EV island and a regular gas island), so they won’t let you drive your car from one side to the other directly. In fact, you drive up to one side of the bridge, leave your vehicle in a parking garage, walk across, and pick up a rental car on the other side. Then, when you’re done driving around the other island, you bring your rental back to the bridge, walk across, and they hand you the keys to your car.

That means for every rental car driving around the island, there’s another car parked in the garage. Some are stored for hours, others for days, others for months, but they’re all just sitting there, and the company that operates the bridge has to keep them all safe. Meanwhile, other unscrupulous people know exactly how many cars are in the garage and are looking for ways to steal them.

Functionally, this means bridges are receiving incoming transactions in one type of cryptocurrency, locking it up as a deposit, and releasing an equivalent amount of cryptocurrency on another blockchain. When bridges get hacked, the attacker is able to withdraw money from one side of the bridge without putting anything in the other side.

Bridges are particularly tempting targets because of all the complex code, creating lots of opportunities for exploitable bugs. As CertiK founder Ronghui Gu explains: “If you’re trying to create a bridge between N different cryptocurrencies, the complexity of that is N squared,” — which means N more chances for bugs to creep in.

Crucially, these different cryptocurrencies aren’t just different units of money: they’re written in different programming languages and deployed in different virtual environments. Figuring out how these things should interact is very hard, especially for on-chain bridges that convert between multiple different coins.

Have bridges made cryptocurrency less secure overall?

Probably not. Attackers are targeting bridges right now because they’re the weakest point in the system — but that’s partially because the industry has done a good job securing the rest of it. Kim Grauer, director of research at Chainalysis — a company that has produced research on DeFi thefts — told The Verge that bridge hacks are taking the place of the previous generation of damaging hacks against exchanges like Coincheck, BitMart or Mt Gox.

“If you looked at our ecosystem just a few years ago, centralized exchanges were the main target of hacks. Every hack it was, ‘Centralized exchange goes down again,’ and the industry worked hard to have solutions that allowed us to overcome these hacking problems,” she says. “We’re seeing a lot of DeFi hacking, but I think the pace of it is actually slowing down. Definitely the rate at which this hacking is going on can’t continue for the industry to grow.”

Isn’t the whole point of the blockchain to prevent this kind of attack?

The problem is that many bridges aren’t on the blockchain at all. The Ronin bridge was set up to work “off-chain,” running as a system that interfaces with the blockchain but exists on servers that are not part of it. These systems are fast, flexible, and relatively lightweight — reducing some of the “N squared” complexity challenges — but can be hit with the same type of hacks that affect web services anywhere on the internet. (“This is not really blockchain,” Gu says. “These are ‘Web2’ servers.”)

Without the blockchain to settle transactions, the Ronin bridge relied on nine validator nodes, which were compromised through a combination of code hacks and unspecified social engineering.

There are other bridge systems that operate as smart contracts — basically, the “on-chain” alternative. It’s less likely that an attacker could subvert the code of an on-chain system through social engineering, and getting majority power over the network is extremely unlikely. The drawback is that the smart contracts themselves are highly complex, and if bugs do exist, it can be hard to update the system in a timely way. (Wormhole used an on-chain system, and the big theft occurred after hackers spotted security updates that were uploaded to GitHub but had not been deployed to the live smart contract.)

How do we stop bridges from getting hacked?

It’s hard. The answer that came up time and time again was “code auditing.” In the type of case described above, where a project’s development team might be working across different programming languages and computing environments, bringing in outside expertise can cover blind spots that in-house talent might miss. But right now, a surprisingly large number of projects don’t have any auditor listed.

Nick Selby, director of assurance practice at specialist security auditing company Trail of Bits, said that this is partly because of how fast the market has sprung up. Most companies are under huge pressure to grow, scale, and build new features to fend off competitors — which can sometimes come at the expense of diligent security work.

“We’re in, I wouldn’t call it necessarily a bubble, but it’s certainly a gold rush,” says Selby. “I think a lot of times, executives who are trying to innovate in the space will look at the desired feature outcome and say, ‘Well, this [product] does have the features I want. Therefore, it’s good.’ And there’s a lot of things they’re not looking at, so they’re not seeing them, which is where the code audit comes in.”



Source: The Verge

Popular posts from this blog

The hidden cost of food delivery

Noah Lichtenstein Contributor Share on Twitter Noah Lichtenstein is the founder and managing partner of Crossover , a diversified private technology fund backed by institutional investors, technology execs and professional athletes and entertainers. More posts by this contributor What Studying Students Teaches Us About Great Apps I’ll admit it: When it comes to food, I’m lazy. There are dozens of great dining options within a few blocks of my home, yet I still end up ordering food through delivery apps four or five times per week. With the growing coronavirus pandemic closing restaurants and consumers self-isolating, it is likely we will see a spike in food delivery much like the 20% jump China reported during the peak of its crisis. With the food delivery sector rocketing toward a projected $365 billion by the end of the decade, I’m clearly not the only one turning to delivery apps even before the pandemic hit. Thanks to technology (and VC funding) we can get a ri

Cyber Monday Canada: Last-minute deals for everyone on your list

Best Cyber Monday Canada deals: Smart Home Audio Phones, Tablets & Accessories Wearables Laptops & PC Components Amazon products Gaming Televisions Cameras Lifestyle & Kitchen Toys & Kids Cyber Monday Canada is here, and retailers are rolling out the red carpet for customers who want to shop for everything from tech to kitchenware to games and everything in between. Unlike years past, Cyber Monday Canada deals look a bit different than normal. Instead of retailers trying to pack their stores with as many shoppers as possible, we're seeing tons of online deals that you can take advantage of from the comfort of your home. We've rounded up our favorites below, so feel free to browse through the best of what Canada Cyber Monday has to offer! This list is being updated with new Cyber Monday deals all the time, so check back often. Spotlight deals It's a Switch Nintendo Switch Fortnite Edition bundle $399.95 at Amazon It's a Switch.

Slack’s new integration deal with AWS could also be about tweaking Microsoft

Slack and Amazon announced a big integration late yesterday afternoon. As part of the deal, Slack will use Amazon Chime for its call feature, while reiterating its commitment to use AWS as its preferred cloud provider to run its infrastructure. At the same time, AWS has agreed to use Slack for internal communications. Make no mistake, this is a big deal as the SaaS communications tool increases its ties with AWS, but this agreement could also be about slighting Microsoft and its rival Teams product by making a deal with a cloud rival. In the past Slack CEO Stewart Butterfield has had choice words for Microsoft saying the Redmond technology giant sees his company as an “existential threat.” Whether that’s true or not — Teams is but one piece of a huge technology company — it’s impossible not to look at the deal in this context. Aligning more deeply with AWS sends a message to Microsoft, whose Azure infrastructure services compete with AWS. Butterfield didn’t say that of course

iPhone 13 Pro vs. iPhone 15 Pro Buyer's Guide: 50+ Differences Compared

The iPhone 15 Pro brings over 50 new features and improvements to Apple's high-end smartphones compared to the iPhone 13 Pro, which was released two years prior. This buyer's guide breaks down every major difference you should be aware of between the two generations and helps you to decide whether it's worth upgrading. The ‌iPhone 13‌ Pro debuted in 2021, introducing a brighter display with ProMotion technology for refresh rates up to 120Hz, the A15 Bionic chip, a telephoto camera with 3x optical zoom, Macro photography and photographic styles, Cinematic mode for recording videos with shallow depth of field, ProRes video recording, a 1TB storage option, and five hours of additional battery life. The ‌iPhone 13‌ Pro was discontinued upon the announcement of the iPhone 14 Pro in 2022, but it is still possible to get hold of it second-hand. Our guide helps to answer the question of how to decide which of these two iPhone models is best for you and serves as a way to c