The $292 Million Kelp DAO Breach Exposes the Vulnerability of Crypto Bridges

The recent $292 million KelpDAO exploit highlights the ongoing issue of crypto bridge hacks, which have become a prominent vulnerability in the blockchain ecosystem. These breaches occur due to the inherent weaknesses in the systems designed to connect different blockchains, allowing for the exploitation of billions of dollars over the years. The root cause of these vulnerabilities is not solely attributed to poor coding or negligence but rather to the fundamental design of bridges. The primary issue lies in the fact that bridges rely on intermediaries to verify transactions between blockchains, rather than conducting independent verifications. This approach creates a single point of failure, which can be compromised by attackers, as seen in the KelpDAO incident where the attackers targeted the data feeding into the bridge. Experts emphasize that bridge hacks often manifest differently on the surface but are symptoms of a deeper design flaw. The process of moving assets between blockchains involves locking tokens on the original chain, followed by a separate system confirming the lock, and then sending a message to the second blockchain to issue new tokens. However, this process is susceptible to compromise if attackers can manipulate the message, leading to the creation of unbacked tokens. The lack of priority on security, coupled with the rush to launch and expand, contributes to the persistence of these vulnerabilities. Furthermore, the complexity added by each new blockchain integration increases the potential for failures. To mitigate these risks, experts suggest removing single points of failure by utilizing independent data sources and implementing hardware protections and better monitoring. Additionally, some developers are exploring designs that verify data directly using cryptography, eliminating the need for intermediaries. Ultimately, a fundamental shift in the design of validator-based bridges is necessary to address these ongoing issues.