Crypto Bridges Remain a Weak Point in the Industry After $292 Million Kelp DAO Exploit

The recent $292 million exploit of KelpDAO has highlighted the ongoing vulnerability of crypto bridges, which have become a prime target for hackers due to their role in connecting blockchains. This incident involved the use of LayerZero's cross-chain messaging system and has raised concerns about the fundamental design of bridges. Crypto ecosystem leaders argue that the problem is not just a matter of poor coding or careless mistakes, but rather a deeper issue related to how bridges are built. At the heart of the problem is the need for bridges to trust a middleman to verify the existence and locking of tokens on the original blockchain, rather than verifying this information independently. This outsourcing of verification creates a risk, as evidenced by the Kelp DAO exploit, where attackers compromised the data feeding into the bridge, leading to a false version of reality being presented to the system. Experts point out that bridge hacks often have different surface-level causes, such as stolen keys or faulty smart contracts, but these are symptoms of a more profound issue related to the design of the systems. The process of using bridges appears simple to users, who can click a button to move assets between blockchains, but behind the scenes, it involves a complex process of locking tokens, confirming their locking, and sending messages between blockchains. However, this process is dependent on trusting the sender of the message, and if attackers compromise this system, they can send false messages and create unbacked tokens. The industry's inability to fix these issues is partly due to incentives, with security often not being the top priority for teams focused on launching quickly and growing their user base. Building secure systems takes time and money, and many DeFi projects operate with limited resources, making it challenging to invest in audits, monitoring, and infrastructure. Moreover, the addition of new blockchain integrations adds complexity, and bridge hacks can have a contagion effect, spreading damage across multiple platforms. To make bridges safer, experts suggest removing single points of failure by relying on independent data sources, implementing hardware protections, and improving monitoring. Some developers are also exploring designs that verify data directly using cryptography, rather than relying on intermediaries. Ultimately, a more fundamental shift in the design of bridges may be necessary to address these ongoing issues.