DeFi Security · Vulnerability class
Bridge and cross-chain verification
A bridge, peg or proof system accepts evidence that a deposit or burn happened when it did not, and mints or pays out against it.
The concept
Everything a bridge believes comes from data an outside party produced. Proof verifiers, message parsers, caches of verification results and identity checks are the critical code.
Defensive lessons
- Add an independent solvency check outside the minting path.
- Cap mints and withdrawals per period.
- Keep proving-system dependencies patched.
- Never read identity from data the sender controls.
Stored incidents
2026-09-24 · reported loss $1.92M
Payy: a forged zero-knowledge proof accepted by the bridge verifierOfficial statement
2026-09-23 · reported loss $2.3M
Meter Passport: unbacked wrapped MTRG minted through the bridgeUnverified
2026-09-11 · reported loss $770K (9.97 BTC)
Symbiosis Bitcoin Bridge: 46.1 billion unbacked syBTC from a 330-satoshi depositIndependent analysis
2026-09-06 · reported loss $32M (4,000 BTC)
Liquid Network: about 4,000 unbacked L-BTC through a proof-cache flawOfficial statement