Yesterday in crypto, explained

Bridges and Wrapped Tokens: How Crypto Moves Between Chains, and Why Bridges Get Hacked

Deck: Blockchains can't talk to each other on their own, so "bridges" do it for them. Here's what actually happens when you bridge a coin, what a wrapped token really is, and why bridges have been some of crypto's biggest hacking targets.

Last reviewed: October 24, 2026

The first time I "moved" a coin to another network, I pictured it traveling across like a car over a bridge. That's not what happens. In most cases the original coin stays put, locked up, and a stand-in appears on the other side. Once that clicked, a lot of the risks made more sense.

This guide explains how bridges and wrapped tokens work, using made-up coins and chains so nothing here reads as a pick. It doesn't recommend any bridge.


The short version

  • Blockchains are islands. A coin on one chain can't move to another chain by itself.
  • A bridge connects them. The most common design locks your coins on one chain and mints a matching "wrapped" token on the other.
  • A wrapped token is an IOU. It's only worth what the locked coins behind it are worth, and only while they're still there.
  • That locked pile is a target. Bridge hacks have been among the largest thefts in crypto.
  • Who checks the transfers matters. Some bridges rely on an outside group; others rely on the blockchains themselves.
  • Scams copy bridges too. Fake bridge sites and wrong-network mistakes cost people money.

Why bridges exist

Each blockchain keeps its own records with its own rules. Ethereum.org's developer docs put it plainly: "Blockchains exist in siloed environments, meaning there is no way for blockchains to trade and communicate with other blockchains naturally."

That's a problem if you hold coins on one network and want to use an app, pay lower fees, or reach people on another. A bridge is software that sets up, in ethereum.org's words, "a transportation route between blockchains where tokens, messages, arbitrary data, and even smart contract calls can be transferred from one chain to another." One common use is moving funds between a main chain and a layer 2 network.

What happens when you bridge: lock and mint

Here's a made-up example. Sam holds 10 ABC coins (made up) on Chain A, and wants to use them on Chain B.

  1. Lock. Sam sends his 10 ABC to the bridge. The bridge holds them in a vault, usually a smart contract, on Chain A.
  2. Mint. The bridge creates 10 "wrapped ABC" (wABC) on Chain B and sends them to Sam's address there.
  3. Use. Sam can now use wABC on Chain B.
  4. Return. To go back, Sam sends the wABC to the bridge. It burns them on Chain B and releases 10 ABC from the vault on Chain A.
The original coins don't travel. They're locked, and a stand-in is minted on the other side. Made-up example. Animation: Fueled Crypto.

Chainalysis, a blockchain analytics firm, describes the same flow: users send funds to the bridge, "where those funds are then locked into the contract," and are "issued equivalent funds of a parallel asset" on the other chain.

Lock and mint isn't the only design. Ethereum.org lists three common ways bridges move value:

Three numbered cards. Lock and mint: lock coins on Chain A, mint wrapped versions on Chain B. Burn and mint: destroy tokens on Chain A, create the same amount on Chain B. Swap: trade your coins on Chain A for someone else's coins on Chain B. A note says wrapped tokens usually come from lock and mint.
Three common ways value crosses between chains. Diagram: Fueled Crypto.

What a wrapped token really is

A wrapped token is a token on one chain that represents an asset held somewhere else. Think of a coat check ticket. The ticket isn't the coat, but it lets you get the coat back, as long as the coat is still there and the coat check honors the ticket.

That leads to the two questions that matter for any wrapped token:

  • Is the backing really there? The locked coins (or whatever backs the token) need to exist in full.
  • Who controls the backing? It might be a smart contract, a group of signers, or a company acting as custodian.

Not all wrapping involves a bridge. Wrapped ether (WETH) lives on Ethereum itself. Ethereum.org explains that "WETH is a representation of ether that complies with the ERC-20 fungible token standard," so it works in apps built for that token format. "New units of WETH are issued by the contract after it receives ETH deposits from users," and burned when someone redeems them for ETH. Same coat check idea, on one chain.

Who checks the transfer?

Every bridge has to answer one question: when a coin is locked on Chain A, who confirms that, so the bridge can mint on Chain B? Ethereum.org groups the answers into two camps.

Two columns. Trusted bridges: an outside group of validators, signers or an oracle checks transfers; often faster and connect to more chains; you rely on that group not to fail or collude. Trustless bridges: the connected blockchains' own validators check transfers; no new group to trust; can be slower or connect to fewer chains. A note says trustless isn't risk-free because code bugs can expose funds either way.
Neither design is risk-free. They trade off different things. Diagram: Fueled Crypto.
  • Trusted bridges "use an external set of verifiers," such as a group of signers, which ethereum.org notes "comes at the cost of security, as users have to rely on the security of the bridge."
  • Trustless bridges "rely on the blockchains they are connecting and their validators," so they don't add a new group to trust. They can be slower or connect fewer chains.

As ethereum.org sums it up: "With bridges, there are no perfect solutions. Rather, there are only trade-offs."

Why bridges get hacked

Here's the uncomfortable part. Chainalysis explains that bridges "often feature a central storage point of funds that back the 'bridged' assets on the receiving blockchain," and that storage point "becomes a target." In August 2022 it estimated that "$2 billion in cryptocurrency has been stolen across 13 separate cross-chain bridge hacks," and that bridge attacks made up 69% of all funds stolen that year up to that point.

Ethereum.org's developer docs list the main risks of using any bridge:

  • Smart contract risk. "All it takes is one flaw in a smart contract for assets to be exposed to hacks."
  • Systemic risk from wrapped assets. If the backing is stolen, wrapped tokens on the other chain can lose their value, and anything built on them can be hit too.
  • Counterparty risk. With trusted designs, users rely on the outside group not to "collude to steal user funds."
  • Open questions. Bridges are still young, and it isn't fully known how they behave under stress.

There are also everyday risks that have nothing to do with code:

  • Fake bridge sites. Copycat pages ask you to connect a wallet and sign an approval. Our token approvals guide explains what you're agreeing to.
  • Wrong network or wrong token. Sending a token on a network the receiver doesn't support can mean it doesn't arrive where you expect, and getting it back can be hard or impossible.
  • Waiting periods. Some withdrawals are slow on purpose. Leaving an optimistic rollup for Ethereum, for example, means waiting out a "challenge period—lasting roughly seven days," per ethereum.org.
  • Fees on both sides. Each chain charges its own network fee, so you may need a little of each chain's coin.

Questions to ask before you bridge

None of these make a bridge safe. They help you understand what you're relying on.

Six numbered question cards: Is this the real site? What will I receive, a native coin or a wrapped IOU? Who checks transfers? How long to come back? Do I have gas on both sides? Did a small test arrive?
Checks, not guarantees. Diagram: Fueled Crypto.

A small test transfer is a common habit. It costs an extra fee but shows you the full round trip before more is at stake. You can watch both sides of the transfer on a block explorer.


Common mix-ups

  • "My coin moved to the other chain." Usually it's locked on the first chain, and a wrapped stand-in was minted on the second.
  • "A wrapped token is the same as the original." It's a claim on the original, and only as good as the backing and whoever holds it.
  • "Trustless means risk-free." It means no extra group to trust. Code bugs are still possible.
  • "A bridge is just a website." The website is the front door. The bridge is the contracts and verifiers behind it, and copycat front doors are common.
  • "Bridging is instant." Some routes take minutes. Some withdrawals take about a week.
  • "Any address works on any network." Sending to a network the receiver doesn't support can mean lost funds.

Words you'll keep hearing

  • Bridge: software that moves tokens or messages between blockchains.
  • Wrapped token: a token on one chain that represents an asset locked or held elsewhere.
  • Lock and mint: lock the original on one chain, create a stand-in on the other.
  • Burn and mint: destroy tokens on one chain and create them on another.
  • Native asset: a coin that's built into its own blockchain, like ETH on Ethereum.
  • Custodian: a person or company that holds assets on someone else's behalf.
  • Validator: a participant that checks and confirms transactions.
  • Oracle: a service that feeds outside information to a blockchain.
  • Challenge period: the waiting window before some layer 2 withdrawals finish.

Frequently asked questions

What is a crypto bridge? Software that moves tokens or data between two blockchains. Most often it locks your coins on one chain and creates matching wrapped tokens on the other.

What is a wrapped token? A token that stands in for an asset held somewhere else, like a coat check ticket. It's only worth what its backing is worth, and only while that backing is still there.

Does my coin actually move when I bridge it? Usually not. In the common lock-and-mint design, the original stays locked on the first chain and a wrapped version is minted on the second.

Why do bridges get hacked so often? They often hold large piles of locked coins in one place, and their designs are complex and still new. Chainalysis estimated in 2022 that bridge attacks accounted for 69% of funds stolen that year to that point.

What happens to wrapped tokens if a bridge is hacked? If the coins backing them are stolen, the wrapped tokens may no longer be fully backed, and their value can fall sharply.

What's the difference between a trusted and a trustless bridge? A trusted bridge relies on an outside group to confirm transfers. A trustless one relies on the connected blockchains themselves. Both can have code bugs.

Why is my withdrawal from a layer 2 taking a week? Optimistic rollups use a challenge period, roughly seven days, before withdrawals to Ethereum finish. It gives time for anyone to dispute a bad transaction.


Where to go next


Sources

All diagrams and animations are original Fueled Crypto graphics. ABC, Chain A, Chain B and everyone in the examples are made up.


Fueled Crypto publishes news and education, not investment, tax, or legal advice. Crypto assets are volatile and can lose value. Do your own research and consider a licensed professional before making financial decisions. See our full disclaimer.

Want plain-English crypto news once a week? Subscribe to Fueled Crypto.


Educational only. Not financial, investment, tax, or legal advice. Do your own research. Read the full disclaimer.