The $292 Million Kelp DAO Breach Highlights the Vulnerability of Crypto Bridges

The recent $292 million breach associated with KelpDAO is the latest in a series of crypto bridge hacks, emphasizing the weaknesses in the systems designed to connect blockchains. This incident involved KelpDAO's use of LayerZero's cross-chain messaging system, a widely used infrastructure for transferring data and assets between blockchains. Crypto bridges are intended to facilitate the movement of assets between different blockchains, but they have repeatedly become the weakest links, resulting in the loss of billions of dollars over the past few years. The problem lies in the fundamental design of bridges, which often rely on trusting intermediaries. To move tokens from one blockchain to another, the second chain needs proof that the tokens existed and were locked on the first one. However, instead of verifying this information independently, bridges often rely on smaller systems to report it, creating a trust issue. This shortcut can lead to risks, as seen in the Kelp DAO-related breach, where attackers targeted the data feeding into the bridge. Experts say that bridge hacks are often symptoms of a deeper issue, and the real problem lies in the design of the systems. The process of using bridges appears simple to users, but it involves a complicated process of locking tokens on the original blockchain, confirming the lock, and sending a message to the second blockchain to issue new tokens. The issue arises when this process depends on trusting the entity sending the message, and if attackers compromise this system, they can send false messages and create unbacked tokens. Given the frequency of bridge failures, the industry's inability to fix them can be attributed to incentives, with security often not being the top priority. Building secure systems requires time and money, and many DeFi projects operate with limited resources, making it challenging to invest in audits, monitoring, and infrastructure. Bridge hacks can have far-reaching consequences, as compromised assets are used across lending protocols, liquidity pools, and yield strategies, leading to contagion. To make bridges safer, experts suggest removing single points of failure by relying on independent data sources and implementing hardware protections and better monitoring. Some developers are working on designs that verify data directly using cryptography instead of intermediaries. Ultimately, a more fundamental shift is needed to address the underlying issues with validator-based bridges.