The $292 Million Kelp DAO Breach Highlights the Vulnerability of Crypto Bridges

A recent $292 million exploit linked to KelpDAO has brought attention to the vulnerability of crypto bridges, which are designed to facilitate the transfer of assets between blockchains. Despite their intended purpose, these bridges have become a common entry point for hackers, resulting in significant financial losses. The problem lies in the fundamental structure of bridges, which often rely on complex systems and shared infrastructure, creating an environment of hidden trust assumptions. The KelpDAO incident involved the use of LayerZero's cross-chain messaging system, a widely used infrastructure for moving data and assets between blockchains. However, this system was compromised, allowing attackers to feed false information into the bridge. Experts argue that the issue is not solely due to bad code or careless mistakes, but rather a result of the inherent design of bridges. To move tokens from one blockchain to another, the second chain requires proof that the tokens existed and were locked on the first chain. Instead of verifying this information independently, bridges often rely on a smaller system to report it, creating a single point of failure. This shortcut can lead to significant risks, as seen in the Kelp DAO-related exploit. Bridge hacks often appear different on the surface but are symptoms of a deeper issue. Experts say that the real problem lies in the design of the systems, which can be vulnerable to code vulnerabilities, centralization issues, social engineering, and economic attacks. The process of using a bridge seems simple for users, but it involves a complex process behind the scenes. Tokens are locked on the original blockchain, and a separate system confirms that the tokens are locked. This system usually consists of a small group of operators or validators who send a message to the second blockchain, stating that the tokens were locked, allowing new ones to be issued. However, this process depends on trusting the system that sends the message, and if attackers compromise this system, they can send false messages and create tokens that were never backed on the original chain. The industry has not yet fixed the issue of bridge security, partly due to incentives, as teams often prioritize launching quickly and growing their user base over investing in security. Building secure systems takes time and money, and many DeFi projects operate with limited resources. Moreover, the complexity of bridges increases with each new integration, adding more assumptions and potential vulnerabilities. Bridge hacks can have far-reaching consequences, as compromised assets are used across lending protocols, liquidity pools, and yield strategies, leading to contagion. Experts suggest that removing single points of failure by relying on independent data sources and using hardware protections, better monitoring, and cryptographic verification can make bridges safer. However, a more fundamental shift in the design of bridges may be necessary to address the underlying issues.