Blockchains operate entirely in isolation. The Ethereum network cannot see what happens on Solana. Bitcoin is completely blind to both of them. Each network has its own separate ledger, its own consensus rules, and its own completely distinct ecosystem. So, how do you get a digital asset to jump across these invisible borders? You don’t. Blockchain bridges do not actually move your tokens from one place to another.
Instead of physically transmitting a token through a digital wire, bridges use a clever combination of smart contracts to coordinate balances. They manipulate the supply on both the source and the destination networks simultaneously. The token you end up holding on the new network is not the exact same token you started with. It is a newly created replica. It is an illusion of movement, tightly coordinated by automated code.
Understanding cross-chain interoperability reveals that the entire system relies on specific mechanisms to keep these disconnected ledgers in sync.
The Lock-and-Mint Architecture
The most common way bridges operate is through a system called lock-and-mint. When you want to transfer your tokens from Network A to Network B, you send your original assets to a specific smart contract address on Network A. This contract takes your tokens and locks them inside a digital vault.
Once the system verifies that your deposit is secure on the source chain, it sends a message to a corresponding smart contract on the destination chain. This second contract then mints an equivalent amount of a “wrapped” token. If you lock up Ethereum, the destination chain prints a token called Wrapped Ethereum (wETH). This newly minted token functions at a strict 1:1 ratio with your locked collateral.
You can then trade, lend, or spend this wrapped token on the new network. It holds value purely because everyone agrees it represents a claim on the original asset locked back on the home chain.
When you decide you want your original tokens back, the process simply runs in reverse. You submit a transaction to burn the wrapped tokens on the destination network. Cryptographic proof of this destruction is sent back to the source network. The original smart contract verifies the burn and unlocks your initial deposit, sending it straight back to your wallet.
The Burn-and-Mint Alternative
Lock-and-mint is not the only way to manage token supplies across chains. The burn-and-mint architecture offers an entirely different approach, primarily used by native token developers who want to control a single, unified global supply across multiple networks.
Instead of locking your assets in a vault, this system permanently destroys them on the source network. You send your tokens to the bridge contract, and the contract executes a burn function. The tokens are wiped from the source ledger completely. A network of independent validators observes this event and relays the cryptographic proof to the destination network.
Blockchain infrastructure providers at Chainlink explain how the burn and mint process issues an exact equivalent of native tokens directly into the user’s wallet on the new chain. Because the tokens are destroyed rather than locked, there are no synthetic IOUs floating around. You hold actual native assets on the new chain.
This method solves a major structural flaw in the lock-and-mint design. It prevents the accumulation of enormous, highly valuable pools of locked collateral on a single smart contract. Those large pools attract unwanted attention from bad actors.
Who Holds the Keys? Custodial vs. Decentralized Bridges
Bridges require verification. Someone, or something, must confirm that a deposit actually happened on Network A before authorizing the printing of tokens on Network B. This introduces a critical question of trust.
Custodial bridges, also known as trusted bridges, rely on a central entity or a specific, closed group of validators. Sometimes this takes the form of a multi-signature wallet. A group of designated operators holds the private keys to the bridge contract. When a user deposits funds, these operators manually or algorithmically sign off on the transaction. The system is relatively simple to build and fast to operate. But it requires you to surrender custody of your funds entirely. If those operators are compromised, the entire system fails.
Trustless bridges operate quite differently. They aim to be fully decentralized, relying strictly on complex cryptographic algorithms and autonomous smart contracts to verify transfers. No human intermediaries hold the keys to the vaults. The security of these bridges theoretically matches the security of the underlying blockchain protocols themselves. But they are entirely dependent on flawless code. A single typo or logical error in the smart contract can unravel the whole architecture.
The Target on the Vault
Lock-and-mint bridges naturally form gigantic digital vaults. Because every wrapped token on the destination chain must be backed by a locked asset on the source chain, these smart contracts hold staggering amounts of cryptocurrency. They are highly lucrative targets for decentralized finance hackers.
If an attacker finds a way into the smart contract and drains the locked collateral from the source chain, the entire system breaks down. The wrapped tokens circulating on the destination chain instantly lose their 1:1 backing. They become unbacked IOUs. Unless the bridge operator or a well-funded investor steps in to manually replace the stolen collateral, the users left holding the wrapped tokens see their value drop to zero.
Security auditors at CertiK have tracked how cross-chain vulnerabilities routinely lead to some of the largest exploits in the industry. The sheer complexity of writing code that securely parses data across two entirely different programming environments creates inevitable blind spots.
When Bridges Break
The theoretical risks of bridge vulnerabilities have played out in reality multiple times. Bad actors actively scan bridge contracts looking for slight misconfigurations or overlooked verification steps.
In early 2022, the Wormhole protocol suffered a catastrophic breach. Analysts at Chainalysis reported that the attacker bypassed signature verification and minted unbacked tokens directly on the Solana network. They exploited a deprecated code function to print the equivalent of hundreds of millions of dollars in Wrapped Ethereum without ever depositing the required collateral on the Ethereum side. They simply printed free money, diluting the supply and causing enormous financial damage.
Just a month later, the Ronin Network experienced an entirely different kind of attack. Instead of hunting for a bug in the smart contract code, the North Korea-affiliated Lazarus Group executed a highly targeted spear-phishing campaign. Security researchers at Merkle Science detailed how attackers compromised validator keys connected to the network.
The bridge relied on nine validator nodes to approve cross-chain transfers. The attackers managed to steal the private keys for five of them. With majority control of the multi-signature wallet, they simply authorized a series of forged withdrawals. They quietly drained hundreds of millions of dollars in Ethereum and USDC before anyone even noticed the funds were missing.
These bridges form the critical infrastructure connecting isolated blockchains. They make the modern, multi-chain digital economy possible. But the mechanism that makes them work—the constant locking, verifying, and printing of assets across disconnected ledgers—ensures they will remain the most highly contested security checkpoints in the industry.