Not fully off bridges

[Alkoc Liya]

Not fully off bridges but a lot more selective now. canonical bridges for major chains like official Arbitrum or Optimism bridge still feel fine. It's the third-party ones where almost every major exploit has happened, the ones routing through their own liquidity pools promising better rates or faster speeds.

For cross-chain swaps between different assets I use both mentioned depending on rates as there's no bridge contract in the middle. The one case where I still bridge manually: moving the same asset between chains, like USDC from mainnet to Base. aggregators tend to want you to swap into something in the process rather than just move it.

[slaman29]

I'm personally lucky, I don't like swapping crosschain or using bridges but I have to admit I do them every now and then and no problems.

But storing my BTC or locking it to 'wrap' it or whatever? Never. Too many exploits.

Bitcoin only. Maybe Ethereum (but these days my trust for them is lower than in 2020).

[hugeblack]

Unless the token is listed on those bridges, I see no reason to use them, as there are many centralized, no-KYC exchanges that offer lower fees and greater security. In short, the token itself determines which of these bridges is the best choice.

[logfiles]

But storing my BTC or locking it to 'wrap' it or whatever? Never. Too many exploits.

With the help of AI, hackers have found those bridges to be a jackpot for them. Notice how the hacks have increase so much in the recent times vs a couple of years back. There's some project I don't quite recall that even posted an announcement saying they were closing their service because they were receiving more than hundreds of hack attempts every day. The couldn't keep up with the pressure and just had to stop the whole service.

[Taskford]

I'm personally lucky, I don't like swapping crosschain or using bridges but I have to admit I do them every now and then and no problems.

But storing my BTC or locking it to 'wrap' it or whatever? Never. Too many exploits.

Bitcoin only. Maybe Ethereum (but these days my trust for them is lower than in 2020).

Seeing how so many exploits happening this days. That actually make me feel off using those options.

Especially for locking my funds in their platform. I'd rather choose those best alternatives rather than choosing what I think the more riskier option.

Unless the token is listed on those bridges, I see no reason to use them, as there are many centralized, no-KYC exchanges that offer lower fees and greater security. In short, the token itself determines which of these bridges is the best choice.

Better for those people to see those hacking issue as reminder for not trusting those platform.

But if they really look around, they provably could see some exchange offering no KYC on each swaps they made. I think they are much safer platforms compare on the option selected or chosen by OP.

[shinratensei_]

For cross-chain swaps between different assets I use both mentioned depending on rates as there's no bridge contract in the middle. The one case where I still bridge manually: moving the same asset between chains, like USDC from mainnet to Base. aggregators tend to want you to swap into something in the process rather than just move it.

Aggregators mostly use Cross-Chain Transfer Protocol (CCTP) by Circle if you're transferring USDC between supported chains, are you sure you're choosing the right routes?
If you want the best security, use CCTP for transfer of USDC between chain and swap on the biggest DEX yourself such as Uniswap. You basically don't interact with shady aggregator routes and your asset don't even touch 3rd party pool while bridging by doing that. Good solution for minimum slippage high security.

[slaman29]

But storing my BTC or locking it to 'wrap' it or whatever? Never. Too many exploits.

With the help of AI, hackers have found those bridges to be a jackpot for them. Notice how the hacks have increase so much in the recent times vs a couple of years back. There's some project I don't quite recall that even posted an announcement saying they were closing their service because they were receiving more than hundreds of hack attempts every day. The couldn't keep up with the pressure and just had to stop the whole service.

Not at all surprised. Even back in 2017 all these alt projects were hiring cheap devs and doing copycat scripts.

And also sleeper scripts were sold for years just hiding their loophole for years until enough money was in the system.

AI is now accelerating that. Truly bad situation.

[boyptc]

There's some project I don't quite recall that even posted an announcement saying they were closing their service because they were receiving more than hundreds of hack attempts every day. The couldn't keep up with the pressure and just had to stop the whole service.

Was it boltz?

A popular service and liked by the community until they have announced the attacks and then original founders have stepped down.

Seeing how so many exploits happening this days. That actually make me feel off using those options.

Especially for locking my funds in their platform. I'd rather choose those best alternatives rather than choosing what I think the more riskier option.

There have been issues even in the past with these locking of funds on these platforms. I have never used them when I have started to see those exploits and they didn't reduced but even more incidents when these hackers got more tools to help them.

[ObeyKnock]

Not fully off bridges but a lot more selective now. canonical bridges for major chains like official Arbitrum or Optimism bridge still feel fine. It's the third-party ones where almost every major exploit has happened, the ones routing through their own liquidity pools promising better rates or faster speeds.

Another thing to keep in mind is that L2Beat classifies USDC transferred via CCTP as being externally bridged rather than natively minted. While Circle is indeed the official issuer of USDC, CCTP is a different beast than an L2s' canonical bridge. This doesn't mean CCTP isn't safe, but it's nice to see that the term "official" actually has multiple categories.

Also, it's important to note that many official bridges are still upgradeable by a small multisig with no/little timelock. This is the same class of attack that occured with Ronin except it applies to bridge contracts instead of a sidechain's validator set. You can read more about this under each chain on L2Beat under their respective upgradability ratings.

TL;DR canonical = safe may not always be the case.

[logfiles]

Not at all surprised. Even back in 2017 all these alt projects were hiring cheap devs and doing copycat scripts.

And also sleeper scripts were sold for years just hiding their loophole for years until enough money was in the system.

AI is now accelerating that. Truly bad situation.

You are absolutely right. People just wanted quick money back then. No body would even bother to audit the scripts or smart contracts for the copycat projects and now it's time to reap

There's some project I don't quite recall that even posted an announcement saying they were closing their service because they were receiving more than hundreds of hack attempts every day. The couldn't keep up with the pressure and just had to stop the whole service.

Was it boltz?

yeah that one exactly. Thanks for reminding me. it was so sad that project mostly the ones that are open source have to even now close to avoid getting hacked and losing clients' money.

[sergiorus]

Not fully off bridges but a lot more selective now. canonical bridges for major chains like official Arbitrum or Optimism bridge still feel fine. It's the third-party ones where almost every major exploit has happened, the ones routing through their own liquidity pools promising better rates or faster speeds.

For cross-chain swaps between different assets I use both mentioned depending on rates as there's no bridge contract in the middle. The one case where I still bridge manually: moving the same asset between chains, like USDC from mainnet to Base. aggregators tend to want you to swap into something in the process rather than just move it.

Third party bridges are basically an obsolete tech now. The secure and liquid option is messaging protocols: Layerzero or CCTP by Circle.

From what I notices, even bridge aggregators mostly suggest them as primary routes nowadays.

[slaman29]

Not at all surprised. Even back in 2017 all these alt projects were hiring cheap devs and doing copycat scripts.

And also sleeper scripts were sold for years just hiding their loophole for years until enough money was in the system.

AI is now accelerating that. Truly bad situation.

You are absolutely right. People just wanted quick money back then. No body would even bother to audit the scripts or smart contracts for the copycat projects and now it's time to reap

Hehe, trust me, they still do. They've just moved on to other things. Show some people here 5% annual interest starting rate on some staking DEX for stablecoin today and you'll get enough bites.

Raise it a little every month, show people millions are staked, then all the greedy people jump on. Audits? Checks? lol these are zero importance to them.

[Odogwu-Blockchain]

I've never used bridges to cross chains before because I don't need the service for my crypto activities, if there is anything that will let me need it, then I'll try to use the cross chains features.

I've always feel like many charges will be incurred on my transaction to move tokens from one chains to another, then why not do that on centralized exchange and get token in another chains with lees fee, what's I do tell myself.

Can't tell what aggregators are good or not, I haven't interacted in their blockchain network.

[Alex Nawlo]

I ended up with roughly the same setup as OP. Canonical bridges when I have to move the same asset between chains, swap aggregators for cross-asset trades when I'd rather not touch a bridge contract.

The attack surface is different. A bridge contract holding pooled liquidity is a huge target, and a bug in that contract is how Wormhole and Nomad got drained. Ronin was a different failure, compromised validator keys, but it still ended with hundreds of millions gone. Swap aggregators don't keep user funds pooled in an on-chain contract for anyone to drain.

For trades like BTC to ETH or ETH to USDT, I use Changelly or ChangeNOW, whichever has the better rate. The service holds your funds for the length of the swap, so there's counterparty risk, but there's no bridge contract involved. That's a different kind of risk from the bridge exploits being discussed here.

[Odogwu-Blockchain]

For cross-chain swaps between different assets I use both mentioned depending on rates as there's no bridge contract in the middle. The one case where I still bridge manually: moving the same asset between chains, like USDC from mainnet to Base. aggregators tend to want you to swap into something in the process rather than just move it.

I've said this before, I don't see any reasons why I should use bridges, if I need coins on other chains, I'll simply use my centralized exchange for it and why I bridge from one chains to another when all these practices had led to so many exploit happening in the space.

So many DeFi exploit happens through this means, connecting your wallet to a DeFi platforms with your funds in it isn't safe anymore, it's now exposed to third party platform that hackers are ready to set their traps.

[Mpamaegbu]

The couldn't keep up with the pressure and just had to stop the whole service.

I applaud them for owing up. It's the most honourable thing to do – to admit lack of control and workability so that users of such services know what they're battling with than allow ego control them and make people lose money through their services.

I've said this before, I don't see any reasons why I should use bridges, if I need coins on other chains, I'll simply use my centralized exchange for it and why I bridge from one chains to another when all these practices had led to so many exploit happening in the space.

Yeah, bridging could be avoidable for investors but it's not that easy for traders who want to move their coins around and buy quickly. Sending to Cexs to convert and then return to buy whatever one needs takes time, and also charges that some may consider wasteful. Thus, that instant bridging. We just have to be mindful of where we move our coins to for swapping or bridging, that's all. Nowhere is absolutely safe in this industry. If Ledger could've a hack issue now, what else should we trust completely?

[Hamza2424]

Not at all surprised. Even back in 2017 all these alt projects were hiring cheap devs and doing copycat scripts.

And also sleeper scripts were sold for years just hiding their loophole for years until enough money was in the system.

AI is now accelerating that. Truly bad situation.

AI had online models that had restrictions in place for such tasks, but with Ollama and offline models, this has become easier than before. But I agree with you that all these years, the same shit was being sold, and that has caused many of these exploits in the big DeFi names.

But every time, the reason was a little bit different. Like, the Ronin Bridge had no loophole. It was a social engineering attack. The Lazarus Group tried to run a bogus job interview, got their malware into the system, and hacked $600+ million in 2022. Many projects had some good people, but they left loopholes on purpose. Like in the Harmony Horizon project, a security researcher warned about a loophole around three months earlier, but they ignored it, their keys got compromised, and they lost around $100M in 2022. There are several events like this, but since the start of 2026, most bridge-related hacks have happened due to flaws in smart contracts because AI has helped hackers.

The DeFi sector alone lost $1.3 billion in 2026 haha. That's a lot of money, bro. Anyway, AI was being used by hackers to find exploits, but it is also being used by white-hat hackers, like that red team that secured many flaws in LN-related projects a few months back.