Crypto Bridges Remain a Weak Point in the Industry After $292 Million Kelp DAO Exploit

The recent $292 million KelpDAO hack highlights the ongoing issue of crypto bridge vulnerabilities, which have resulted in the loss of billions of dollars over the years. These bridges, designed to facilitate the transfer of assets between blockchains, have instead become a prime target for hackers. The problem lies in their structural design, which relies on shared infrastructure and trust assumptions. The KelpDAO exploit involved the use of LayerZero's cross-chain messaging system, a common infrastructure used to move data and assets between blockchains. However, this system can be compromised, allowing attackers to feed false information into the bridge. Experts argue that the issue is not just a matter of bad code or careless mistakes, but rather a fundamental flaw in how bridges are built. The core problem is the reliance on a middleman to verify transactions, which creates a single point of failure. Most bridges do not fully verify transactions on their own, instead relying on a smaller system to report the information. This shortcut creates risk, as seen in the Kelp DAO-related exploit, where attackers compromised the data feeding into the bridge. Bridge hacks often appear different on the surface, but experts say they are symptoms of a deeper issue. The real problem lies in the design of the systems, which can be vulnerable to code vulnerabilities, centralization issues, social engineering, and economic attacks. For users, bridges appear simple, but the process is more complicated. Tokens are locked on the original blockchain, and a separate system confirms the lock. However, this process depends on trusting the sender of the message, which can be compromised. The worst-case scenario is when the system is not checking anything and is simply trusting someone else's version of events. Given the frequency of bridge failures, it is surprising that the industry has not fixed them. Part of the answer lies in incentives, with security often not being the top priority. Teams focus on launching quickly, growing users, and increasing total value locked, rather than investing in audits, monitoring, and infrastructure. Building secure systems takes time and money, and many DeFi projects operate with limited resources. The addition of new blockchains also adds complexity, with each new connection introducing more assumptions. Bridge hacks can have far-reaching consequences, as compromised assets are used across lending protocols, liquidity pools, and yield strategies. If these assets are compromised, the damage can spread, with other platforms treating the hacked asset as legitimate. To make bridges safer, experts recommend removing single points of failure by relying on independent data sources rather than shared infrastructure. Other approaches include hardware protections, better monitoring, and designs that verify data directly using cryptography instead of intermediaries. Ultimately, a more fundamental shift is needed, with some experts believing that validator-based bridges will continue to pose problems until a new design is implemented.