Pith. sign in

REVIEW 4 major objections 5 minor 95 references

Hedge Funds on a Swamp: Analyzing Patterns, Vulnerabilities, and Defense Measures in Blockchain Bridges

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that most blockchain bridge hacks come from two classes of failure—off-chain trust failures and on-chain validation bugs—and that fully trustless designs have so far escaped major exploits.

desk verdict Useful SoK-style synthesis with original measurements, but overclaims novelty and its 'trustless is safer' conclusion needs a reproducible dataset and a consistent classification before it should be taken at face value. read the letter →

arxiv 2507.06156 v3 pith:52Y2JCVH submitted 2025-07-08 cs.ET cs.CR

Poupak Azad , Jiahua Xu , Yebo Feng , Preston Strowbridge , Cuneyt Akcora This is my paper · ORCID
classification cs.ETcs.CR
keywords blockchainbridgescross-chainsecuritytrustlessverificationbridgeattacksurfacessmartcontractstaticanalysistransactionnetworkvalidatorcompromiseexploittaxonomy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Blockchain bridges move tens of billions of dollars between chains every month and are the single largest source of financial loss in Web3. This paper tries to establish that the losses are not random or cryptographic: most successful exploits fall into two classes, off-chain trust failures (stolen keys, compromised signers, insider control) and on-chain validation bugs (forged proofs, broken access control, unchecked calls). It formalizes three bridge security priors (peg, causality, consistency), a layered threat model across source chain, off-chain, and destination chain components, and evaluates 43 attacks alongside static code from 13 bridges. Its central conclusion is that trustless designs—light-client and rollup-native bridges with no external signers—have so far withstood real-world attacks, while trusted and trust-minimized bridges remain disproportionately exposed. If the paper is right, bridge security is largely a matter of subtracting trusted signers and rigorously validating proof-checking code, not of inventing stronger cryptography.

What carries the argument

The load-bearing mechanism is a layered attack-surface model combined with a trust-set decomposition. A bridge's trust set is written $T=T_{\mathrm{src}}\cup T_{\mathrm{off}}\cup T_{\mathrm{dest}}$, and its attack surface is $\Sigma=\langle T, I\rangle$, where $I$ is the implementation. Three security priors are formalized: bridge peg (equation 4), bridge causality (equation 5), and bridge consistency (equations 6 and 7), with an attack defined as a malicious violation of any of them. The damage-to-effort ratio $\mathrm{der}(V)=I(V)/E(V)$ converts incident stories into a scalar whose sum over vectors gives a bridge's attack surface area. These objects carry the argument by letting the paper map every historical exploit to a specific layer and trust assumption, and then read off which designs remove entire classes of vectors (notably V3) by having no external signers at all.

What would settle it

A documented, confirmed exploit of a fully trustless light-client bridge or rollup-native bridge, such as a forged proof or state root accepted by a light-client contract or a fraud-proof bypass, would directly contradict the paper's central design claim; one concrete check is whether any Cosmos IBC channel or Ethereum rollup bridge has suffered a fund-draining incident through verification logic since 2021.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that bridge vulnerability is a design property, not an accident. The majority of the 43 representative attacks violate the causality or consistency priors, while the peg prior is violated only as a downstream effect of unauthorized minting or release. Across the incident table, two vectors dominate—access control flaws (V3) and key leakage or theft (V13), each appearing ten times—and these map cleanly onto the two failure classes: off-chain trust failures (Ronin, Harmony, Multichain, Orbit) and on-chain validation bugs (Poly Network, Wormhole, Nomad, BSC Token Hub, Qubit). The paper argues that no major exploit has occurred on fully trustless light-client bridges or rollup-native bridges, whereas trusted and loosely trust-minimized bridges, whose validator sets are weaker than either chain's consensus, keep falling. The damage-to-effort ratio, $\mathrm{der}(V)=I(V)/E(V)$, is introduced to explain why these vectors persist: the impact is often hundreds of millions of dollars while the effort, key theft or a poorly audited contract, remains relatively low.

Load-bearing premise

The central claim depends on the completeness and representativeness of the dataset of 43 attacks: if a real exploit on a fully trustless light-client or rollup bridge was missed, or a bridge-type label is wrong, the conclusion that trustless designs are safer loses its empirical ground.

Editorial extensions

If this is right

  • Bridge security investment should shift from stronger cryptography to shrinking the trust set: eliminating multisig signers and adopting light-client verification removes the two highest-frequency vectors.
  • Rollup-native bridges and IBC-style light-client channels should be the default for compatible chains, because their security reduces to the underlying chains' own consensus.
  • Layered validation, such as requiring both an off-chain multisig and an on-chain light client to agree, should drastically cut exploit probability, at the cost of added complexity and latency.
  • Verification-logic bugs (Wormhole, BSC Token Hub) argue for formal verification and independent double-checks of proof code, not just conventional audits.
  • Detection latency and containment need to become first-class benchmarks, since the Ronin case shows a $624 million theft going unnoticed for six days.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 'trustless has never been hacked' conclusion is only as strong as the incident dataset behind Table 8; a single missed exploit on a light-client or rollup bridge would invert the design ranking, so a completeness audit of attack collections is a natural next step.
  • The damage-to-effort framework suggests a testable prediction: bridges whose trust set is a bonded, slashable validator set with hundreds of nodes should show attack rates between those of naive multisigs and light-client designs, and that gradient could be quantified from incident history.
  • The transaction tracing is Ethereum-centric, so extending the same methodology to Solana and Cosmos exploit flows could reveal laundering and attacker-behavior patterns that are invisible from an Ethereum full node.
  • If the design hierarchy holds, insurance underwriters and regulators could price bridge risk by trust-set size and verification method, an application the paper itself does not develop.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper presents a systematization of blockchain bridge security, combining a formal model of bridge architectures and trust sets, a taxonomy of 23 attack vectors, a static analysis of 16 deployed smart contracts, transaction-level tracing of 18 attacker wallets, and a catalog of 43 real-world incidents. The authors argue that most bridge exploits stem from off-chain trust failures and on-chain validation bugs, and that fully trustless designs (light-client and rollup-native bridges) have so far resisted major attacks while trusted and trust-minimized bridges remain disproportionately vulnerable. They also discuss detection, mitigation, and outlook in four research questions.

Significance. If the central empirical claim held, the paper would provide actionable guidance for bridge architects by shifting attention from cryptographic weaknesses to trust-set design and verification-logic correctness. The paper usefully assembles a broad incident table, a layered threat model, and a concrete static-analysis metric set; it also ships traceable case narratives for Ronin, Wormhole, Nomad, and others. However, the load-bearing conclusion is undermined by an internal contradiction involving the BSC Token Hub incident and by the absence of a verifiable incident-selection and classification methodology. The taxonomy and formal framework have merit, but the empirical claims need substantial rework before the conclusions are reliable.

major comments (4)
  1. [Section 5 (RQ1), Appendix F, Table 8] The central claim that "no major exploits have occurred on fully trustless light-client bridges or rollup bridges" is contradicted by the manuscript's own Binance Bridge/BSC Token Hub case. Appendix F states that the root cause was "a bug in the light-client based proof verification" and that "even a seemingly trustless bridge (a light-client-based one) can have implementation flaws in its verification logic," while Table 8 classifies the same incident as "Custodial" with technique "Proof Verifier Bug" (V9). If BSC Token Hub is excluded from the trustless category because of custodial control, the category is effectively defined by custody rather than by verification mechanism, and the claim that trustless verification has not been breached becomes circular; if it is included, the "no major exploits" claim is false. Please reconcile the taxonomy with this case, and provide a rubric that maps each incident to the Section 3.3 trust-set definitions.
  2. [Section 5, Table 8] The empirical foundation of RQ1 is not verifiable as presented. The paper does not state how the 43 attacks were selected, does not provide a completeness analysis, and does not supply the dataset (the "repository URL" mentioned in Section 2 is not given). The negative claim about trustless bridges depends on the set of considered incidents being representative and complete, so a missed or mislabeled exploit would invalidate the conclusion. In addition, the "Architecture Type" labels in Table 8 are asserted without a visible mapping from Section 3.3's T_src/T_off/T_dest definitions to each incident; for example, "Binance Bridge" is labeled Custodial despite the appendix describing light-client verification. Please add the incident-selection methodology, a completeness discussion, and a per-incident classification rubric.
  3. [Section 3.6, Appendix E, Tables 2 and 8] The attack-vector numbering used in Table 8 is unreliable because the vector definitions in Appendix E do not match Table 2. Table 2 defines V3 as access control, V9 as malicious transaction modification, and V10 as light-client verification flaws, whereas Appendix E assigns V3 to reentry, V9 to oracle manipulation, and V10 to consensus failure, and it lists only vectors V1–V18 against Table 2's V1–V23. Since Table 8 uses these vector codes (e.g., V9 for the Binance proof-verifier bug and V10 for Nomad's trusted-root exploit), the frequency counts and causal attributions built on them cannot be checked. The two lists must be aligned, or the vector codes should be removed from the incident table.
  4. [Section 3.5.2, Eq. (8)] Definition 3.5 first defines der(V)=I(V)/E(V) as a damage-to-effort ratio, then immediately redefines the same symbol as an indicator: "der(V)=1 if der(V)>1, 0 otherwise." Equation (8) sums these indicator values while the surrounding text and Section 5 interpret der as a ratio ("high damage-to-effort ratios"). This conflation makes the formal attack-surface model internally inconsistent and should be fixed by introducing a separate viability indicator, e.g., viable(V)=1[der(V)>1], and using it in the area sum.
minor comments (5)
  1. [Appendix B vs. main text] The theorem is numbered Theorem 1 in Section 3.4 but appears as Theorem 2 in Appendix B; please renumber consistently.
  2. [Section 3.2.3] The transaction definition tx_b2=(theta_2, v_2=0, ...) conflicts with the subsequent balance update a_2 maps to v_x-f_2; clarify that v_2 is the amount in the transaction tuple, not the resulting balance.
  3. [Section 4.2 and Table 10] The text reports "6 out of 18 wallets continued transacting," but Table 10 lists 19 exploit addresses; please align the count and provide full addresses in a supplementary dataset.
  4. [Section 2] The phrase "available at our repository URL" is a placeholder; include an actual URL or remove the pointer so reviewers can access the claimed dataset and code.
  5. [Table 10 caption] The caption contains a typo, "Blockhain," and the address entries are truncated; consider providing complete addresses in the data release.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central empirical claims rest on external incident data and independent code/transaction analysis, not on self-referential definitions or fitted parameters.

full rationale

The paper's central claims are empirical. Table 8's 43 incidents are labeled from external reports, the static code metrics in Tables 3-5 come from deployed contracts, and the transaction traces come from a Geth full node (Section 4.2). None of these are fitted parameters renamed as predictions. The formal apparatus (Definitions 3.1-3.5, Theorem 1) is not load-bearing for the main conclusions: Theorem 1's claim that every attack violates the peg requires the substantive argument in Appendix B, not merely Definition 3.1, since an attack is defined as violating any one of (4)-(7), not necessarily (4). The RQ1 claim that no major exploit has hit fully trustless light-client or rollup bridges is classification-sensitive. The paper's own BSC Token Hub case is labeled 'Custodial' in Table 8 and Table 9, so excluding it from the 'fully trustless' set is consistent with the paper's stated trust-model definitions rather than a definitional dodge; the tension with Appendix F ('even a seemingly trustless bridge (a light-client-based one) can have implementation flaws') is a potential labeling/validity concern, not circularity. The only self-citations ([37,38]) support a minor research-gap remark in RQ2 and are not load-bearing for the bridge-security thesis. No derivation reduces to its own inputs by construction.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No free parameters: the paper fits no quantitative model. Axioms: the study assumes blockchain liveness, dataset representativeness, the sufficiency of its three security priors, and completeness of its attack-vector taxonomy. No invented entities: the priors and der(V) are definitions, not new physical entities.

assumptions (4)
  • domain assumption Underlying blockchains are live and capable of processing transactions in a timely manner
    Stated in Section 3.4; the paper does not model liveness failures such as chain halts or finality reorgs, which are real bridge risks (e.g., delayed finality vectors V17/V20).
  • domain assumption The 43 attack scenarios and Table 8 incident list are representative and complete enough to support comparative safety claims across bridge architectures
    Used to conclude trustless bridges have not been breached (Section 5 RQ1); no completeness analysis is provided, and tracing is Ethereum-centric (Section 4.2).
  • domain assumption The three security priors (peg, causality, consistency) in Section 3.4 capture the relevant bridge security properties
    Attacks are classified as violations of these priors (Definition 3.1); attacks that do not violate one of these priors are out of scope, which may omit classes such as governance/rugpull affecting value without violating causality.
  • domain assumption The attack vector taxonomy in Table 2 is complete and disjoint
    Used to assign each incident exactly one vector in Table 8; overlapping or missing vectors would distort the frequency counts.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hedge Funds on a Swamp: Analyzing Patterns, Vulnerabilities, and Defense Measures in Blockchain Bridges." pith.science (2026). https://pith.science/paper/52Y2JCVH

@misc{pith2026250706156,
  author       = {Pith},
  title        = {Pith review of: Hedge Funds on a Swamp: Analyzing Patterns, Vulnerabilities, and Defense Measures in Blockchain Bridges},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/52Y2JCVH}},
  note         = {Machine review of arXiv:2507.06156}
}
abstract

Blockchain bridges have become essential infrastructure for enabling interoperability across different blockchain networks, with more than $24B monthly bridge transaction volume. However, their growing adoption has been accompanied by a disproportionate rise in security breaches, making them the single largest source of financial loss in Web3. For cross-chain ecosystems to be robust and sustainable, it is essential to understand and address these vulnerabilities. In this study, we present a comprehensive systematization of blockchain bridge design and security. We define three bridge security priors, formalize the architectural structure of 13 prominent bridges, and identify 23 attack vectors grounded in real-world blockchain exploits. Using this foundation, we evaluate 43 representative attack scenarios and introduce a layered threat model that captures security failures across source chain, off-chain, and destination chain components. Our analysis at the static code and transaction network levels reveals recurring design flaws, particularly in access control, validator trust assumptions, and verification logic, and identifies key patterns in adversarial behavior based on transaction-level traces. To support future development, we propose a decision framework for bridge architecture design, along with defense mechanisms such as layered validation and circuit breakers. This work provides a data-driven foundation for evaluating bridge security and lays the groundwork for standardizing resilient cross-chain infrastructure.

Figures

Figures reproduced from arXiv: 2507.06156 by the authors.

Figure 2
Figure 2. Sidechain Implementation 3.3.3 Destination Chain Implementation Tdest. The destination side enforces token minting, final validation, and recipient assignment. Possible methods include smart contracts (Tdest = {𝑆𝐶𝑠}), validator￾control (Tdest = {}), custodian-based (Tdest = {𝐶}), or a hybrid that integrates these techniques. The choice depends on constraints related to cost, security, and overall efficiency. Smart C… view at source ↗
Figure 1
Figure 1. Light Client Implementation Light Clients. Light clients rely on Merkle proofs (𝑀) and per￾form verification on-chain via light client contracts (𝐿). These sys￾tems do not depend on external entities, so the off-chain trust set is Toff = {𝐿, 𝑀}. These bridges are trust-minimized because no ex￾ternal entities are needed beyond the blockchain itself. Verification time 𝑡proof affects expected loss costs E(𝐶) and bridge… view at source ↗
Figure 3
Figure 3. Attack flow of the Ronin Bridge exploit. The attacker gained control of 5 out of 9 Ronin Bridge validators and used them to sign and submit forged withdrawals. The stolen funds amounted to 173,600 ETH, along with an additional 25.5 million USDC that was exchanged for 8,564 ETH. all transactions via Ethereum-ETL (https://github.com/blockchain￾etl/ethereum-etl). We visualize the attack patterns in transaction graphs t… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Poly Network Exploiter Address (ETH) Replaced public key, took over bridge trust Hoo Day 0 ~0.47 ETH Gas Funding Day 1 $274.46M Exploiter Address (Polygon) Exploiter Address (BSC) Day 1 $250.8M Day 1 $85M Curve.fi Day 1 673,227 DAI and 96,389,444 USDC Ellipsis Finance …
Figure 6
Figure 6. Figure 6: Attack flow of the Wormhole bridge exploit. without any real ETH locked on Ethereum. The exploit structure is depicted in [PITH_FULL_IMAGE:figures/full_fig_p022_6.png]
Figure 7
Figure 7. Figure 7: Attack flow of the Qubit bridge exploit. The Nomad bridge (connecting Ethereum with Moonbeam and other chains) suffered a $190 million loss in one of the most chaotic exploits to date. Nomad was an optimistic messaging bridge, mean￾ing it had a system of bonded updater…
Figure 8
Figure 8. Figure 8: Attack flow of the Nomad bridge exploit. Harmony’s Horizon bridge (connecting Harmony’s chain with Ethereum) was hacked for about $100 million in assets, through a straightforward attack on its 2-of-5 multisig validators. Similar to Ronin, the attackers somehow obtaine…
Figure 9
Figure 9. Figure 9: Attack flow of the Horizon bridge exploit. An attacker exploited the Binance Smart Chain’s main bridge (between BSC and its Beacon Chain) and managed to mint 2 million BNB (≈ $586 million). The root cause was a bug in the light-client based proof verification on the BS…
Figure 11
Figure 11. Figure 11: Attack flow of the Multichain exploit [PITH_FULL_IMAGE:figures/full_fig_p023_11.png]
Figure 12
Figure 12. Figure 12: Attack flow of the Omni bridge exploit. Smaller but instructive bridge attacks continued through 2024. For example, Orbit Chain (Jan 2024) lost $10M when 7 of its 10 bridge validators were compromised, another case of federated signer failure. An exploit in ALEX Bridg…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

95 extracted references · 76 canonical work pages

  1. [1]

    Bridge Volume - DefiLlama

    “Bridge Volume - DefiLlama. ” https://defillama.com/bridges. Accessed: 2025-05- 29

    2025

  2. [2]

    Rollups are the most secure bridges

    B. Kiepuszewski, “Rollups are the most secure bridges. ” https://archive.devcon. org/devcon-6/rollups-are-the-most-secure-bridges/, 2022. Devcon 6, Bogota, October 13, 2022

    2022

  3. [3]

    Multichain

    “Multichain. ” https://multichain.org/. Accessed: 2025-04-24

    2025

  4. [4]

    Ronin bridge

    “Ronin bridge. ” https://docs.roninchain.com/apps/ronin-bridge, 2025. Accessed: 2025-05-21. Official documentation for the Ronin Bridge, facilitating ERC-20 token and NFT transfers between Ethereum and the Ronin chain

    2025

  5. [5]

    Rainbow bridge

    “Rainbow bridge. ” https://rainbowbridge.app/, 2025. Accessed: 2025-05-21. Offi- cial interface for the Rainbow Bridge, facilitating trustless and permissionless asset transfers between Ethereum, NEAR, and Aurora blockchains

    2025

  6. [6]

    Polygon plasma bridge

    “Polygon plasma bridge. ” https://docs.polygon.technology/, 2025. Accessed: 2025- 05-21. Official documentation for the Polygon Plasma Bridge, enabling secure asset transfers between Ethereum and Polygon using Ethereum’s Plasma scaling framework

    2025

  7. [7]

    Xchain- watcher: Monitoring and identifying attacks in cross-chain bridges,

    A. Augusto, R. Belchior, J. Pfannschmidt, A. Vasconcelos, and M. Correia, “Xchain- watcher: Monitoring and identifying attacks in cross-chain bridges, ”arXiv preprint arXiv:2410.02029, 2024

    arXiv 2024

  8. [8]

    Safeguarding blockchain ecosystem: Understanding and detecting attack transactions on cross-chain bridges,

    J. Wu, K. Lin, D. Lin, B. Zhang, Z. Wu, and J. Su, “Safeguarding blockchain ecosystem: Understanding and detecting attack transactions on cross-chain bridges, ”arXiv preprint arXiv:2410.14493, 2024

    arXiv 2024

Show all 95 references
  1. [9]

    Sok: A review of cross-chain bridge hacks in 2023,

    N. Belenkov, V. Callens, A. Murashkin, K. Bak, M. Derka, J. Gorzny, and S.- S. Lee, “Sok: A review of cross-chain bridge hacks in 2023, ”arXiv preprint arXiv:2501.03423, 2025

    2023 arXiv

  2. [10]

    Blockchain cross- chain bridge security: Challenges, solutions, and future outlook,

    N. Li, M. Qi, Z. Xu, X. Zhu, W. Zhou, S. Wen, and Y. Xiang, “Blockchain cross- chain bridge security: Challenges, solutions, and future outlook, ”Distributed Ledger Technologies: Research and Practice, vol. 4, no. 1, pp. 1–34, 2025

    2025

  3. [11]

    Ethereum

    “Ethereum. ” https://ethereum.org/, 2025. Accessed: 2025-05-21. Official website of Ethereum, a decentralized platform supporting smart contracts and decentralized applications (dApps)

    2025

  4. [12]

    Seamlessly transferring assets through layer- 0 bridges: An empirical analysis of stargate bridge’s architecture and dynamics,

    C. Huang, T. Yan, and C. J. Tessone, “Seamlessly transferring assets through layer- 0 bridges: An empirical analysis of stargate bridge’s architecture and dynamics, ” inCompanion Proceedings of the ACM Web Conference 2024, pp. 1776–1784, 2024

    2024

  5. [13]

    Polygon

    “Polygon. ” https://polygon.technology/, 2025. Accessed: 2025-05-21. Official website of Polygon, an Ethereum scaling platform offering Layer 2 solutions such as the PoS chain, zkEVM, and other modular frameworks for building interoperable blockchain networks

    2025

  6. [14]

    Binance smart chain whitepaper,

    Binance, “Binance smart chain whitepaper, ” 2020

    2020

  7. [15]

    Avalanche

    “Avalanche. ” https://avax.network/, 2025. Accessed: 2025-05-21. Official website of Avalanche, a high-performance Layer 1 blockchain platform developed by Ava Labs, featuring a unique three-chain architecture (X-Chain, C-Chain, and P-Chain) and the Avalanche Consensus Protoco...

    2025

  8. [16]

    Arbitrum

    “Arbitrum. ” https://arbitrum.io/, 2025. Accessed: 2025-05-21. Official website of Arbitrum, a Layer 2 scaling solution for Ethereum utilizing optimistic rollups to enhance transaction throughput and reduce fees while maintaining security. Hedge Funds on a Swamp: Analyzing Pat...

    2025

  9. [17]

    Optimism

    “Optimism. ” https://www.optimism.io/, 2025. Accessed: 2025-05-21. Official website of Optimism, a Layer 2 scaling solution for Ethereum utilizing optimistic rollups to enhance transaction throughput and reduce fees while maintaining security

    2025

  10. [18]

    Bench- marking blockchain bridge aggregators,

    S. Subramanian, A. Augusto, R. Belchior, A. Vasconcelos, and M. Correia, “Bench- marking blockchain bridge aggregators, ” in2024 IEEE International Conference on Blockchain (Blockchain), pp. 37–45, IEEE, 2024

    2024

  11. [19]

    Xchaindatagen: A cross- chain dataset generation framework,

    A. Augusto, A. Vasconcelos, M. Correia, and L. Zhang, “Xchaindatagen: A cross- chain dataset generation framework, ”arXiv preprint arXiv:2503.13637, 2025

    2025 arXiv

  12. [20]

    Sok: Security and privacy of blockchain interoperability,

    A. Augusto, R. Belchior, M. Correia, A. Vasconcelos, L. Zhang, and T. Hardjono, “Sok: Security and privacy of blockchain interoperability, ” in2024 IEEE Symposium on Security and Privacy (SP), pp. 3840–3865, IEEE, 2024

    2024

  13. [21]

    ” https://app.nomad.xyz/, 2025

    “Nomad. ” https://app.nomad.xyz/, 2025. Accessed: 2025-05-21. Official website of Nomad, a security-first cross-chain messaging protocol enabling secure and gas-efficient communication between blockchains

    2025

  14. [22]

    Track and trace: Automatically uncovering cross-chain transactions in the multi-blockchain ecosystems,

    D. Lin, Z. Zheng, J. Wu, J. Yang, K. Lin, H. Xiao, B. Song, and Z. Zheng, “Track and trace: Automatically uncovering cross-chain transactions in the multi-blockchain ecosystems, ”arXiv preprint arXiv:2504.01822, 2025

    2025 arXiv

  15. [23]

    Bitcoin

    “Bitcoin. ” https://bitcoin.org/, 2025. Accessed: 2025-05-21. Official website of Bitcoin, the first decentralized cryptocurrency and blockchain network

    2025

  16. [24]

    Solana

    “Solana. ” https://solana.com/, 2025. Accessed: 2025-05-21. Official website of Solana, a high-performance blockchain platform supporting decentralized appli- cations and smart contracts

    2025

  17. [25]

    Orbs network

    “Orbs network. ” https://www.orbs.com/, 2025. Accessed: 2025-05-21. Official website of Orbs Network, a decentralized Layer-3 blockchain infrastructure designed to enhance the capabilities of existing smart contracts by providing decentralized backend services

    2025

  18. [26]

    Xai games

    “Xai games. ” https://xai.games/, 2025. Accessed: 2025-05-21. Official website of Xai Games, a Layer 3 blockchain platform built on Arbitrum, designed to bring AAA gaming experiences to Web3 by enabling seamless integration of blockchain technology into games

    2025

  19. [27]

    zksync

    “zksync. ” https://zksync.io/, 2025. Accessed: 2025-05-21. Official website of zkSync, a Layer 2 Ethereum scaling solution utilizing zero-knowledge rollups to enhance scalability and reduce transaction costs while maintaining high security

    2025

  20. [28]

    Wormhole

    “Wormhole. ” https://wormhole.com/. Accessed: 2025-04-24

    2025

  21. [29]

    Loopring

    “Loopring. ” https://loopring.org/, 2025. Accessed: 2025-05-21. Official website of Loopring, a Layer 2 zkRollup protocol on Ethereum that enables scalable, secure, and low-cost decentralized trading and payments

    2025

  22. [30]

    Connext: The interoperability protocol for cross-chain applications

    Connext, “Connext: The interoperability protocol for cross-chain applications. ” https://www.connext.network/, 2025. Accessed: 2025-06-03

    2025

  23. [31]

    Across: Cross-chain bridge for ethereum and layer 2 networks

    Across, “Across: Cross-chain bridge for ethereum and layer 2 networks. ” https: //across.to/, 2025. Accessed: 2025-06-03

    2025

  24. [32]

    Qubit finance

    “Qubit finance. ” https://qbt.fi/, 2025. Accessed: 2025-05-21. Official website of Qubit Finance, a decentralized money market platform on Binance Smart Chain (BSC) that connects lenders and borrowers efficiently and securely

    2025

  25. [33]

    Tornado cash

    “Tornado cash. ” https://tornado.cash/, 2025. Accessed: 2025-05-21. Official website of Tornado Cash, a decentralized, non-custodial privacy protocol on Ethereum that uses zero-knowledge proofs to enable anonymous transactions

    2025

  26. [34]

    Horizon bridge

    “Horizon bridge. ” https://bridge.harmony.one/, 2025. Accessed: 2025-05-21. Offi- cial website of Horizon Bridge, a cross-chain bridge developed by Harmony that facilitates the transfer of crypto assets between Ethereum, Binance Smart Chain, and Harmony networks

    2025

  27. [35]

    Cosmos patches ‘critical’ ibc protocol bug, saving $126m,

    B. Lindrea, “Cosmos patches ‘critical’ ibc protocol bug, saving $126m, ” 2024. Accessed: 2025-05-19

    2024

  28. [36]

    Li.fi: With bridges, trust is a spectrum,

    A. Chand and M. Murdock, “Li.fi: With bridges, trust is a spectrum, ” July 2022. LI.FI Knowledge Hub

    2022

  29. [37]

    Alphacore: data depth based core decomposition,

    F. Victor, C. G. Akcora, Y. R. Gel, and M. Kantarcioglu, “Alphacore: data depth based core decomposition, ” inProceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 1625–1633, 2021

    2021

  30. [38]

    Machine learning for blockchain data analy- sis: Progress and opportunities,

    P. Azad, C. Akcora, and A. Khan, “Machine learning for blockchain data analy- sis: Progress and opportunities, ”Distributed Ledger Technologies: Research and Practice, 2024

    2024

  31. [39]

    Ef/cf: High performance smart contract fuzzing for exploit generation,

    M. Rodler, D. Paaßen, W. Li, L. Bernhard, T. Holz, G. Karame, and L. Davi, “Ef/cf: High performance smart contract fuzzing for exploit generation, ” in8th IEEE European Symposium on Security and Privacy, EuroS&P 2023, Delft, Netherlands, July 3-7, 2023, pp. 449–471, IEEE, 2023

    2023

  32. [40]

    Chainlink cross-chain interoperability protocol (ccip)

    Chainlink Labs, “Chainlink cross-chain interoperability protocol (ccip). ” https: //chain.link/cross-chain, 2025. Accessed: 2025-04-24

    2025

  33. [41]

    Sok: Validating bridges as a scaling solution for blockchains,

    P. McCorry, C. Buckland, B. Yee, and D. Song, “Sok: Validating bridges as a scaling solution for blockchains, ”Cryptology ePrint Archive, 2021

    2021

  34. [42]

    ICT Convergence Powered by Smart Intelligence

    Han’guk T’ongsin Hakhoe, IEEE Communications Society, Denshi J¯oh¯o Ts¯ushin Gakkai (Japan). Ts¯ushin Sosaieti, Institute of Electrical, and E. Engineers,ICTC 2018 : the 9th International Conference on ICT Convergence : "ICT Convergence Powered by Smart Intelligence" : October...

    2018

  35. [43]

    SoK: Not Quite Water Under the Bridge: Review of Cross-Chain Bridge Hacks,

    S.-S. Lee, A. Murashkin, M. Derka, and J. Gorzny, “SoK: Not Quite Water Under the Bridge: Review of Cross-Chain Bridge Hacks, ” in2023 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp. 1–14, IEEE, 10 2023

    2023

  36. [44]

    Exploring Blockchains Interoperability: A Systematic Survey,

    G. Wang, Q. Wang, and S. Chen, “Exploring Blockchains Interoperability: A Systematic Survey, ”ACM Computing Surveys, vol. 55, pp. 1–38, 12 2023

    2023

  37. [45]

    A Survey on Blockchain Interoperability: Past, Present, and Future Trends,

    R. Belchior, A. Vasconcelos, S. Guerreiro, and M. Correia, “A Survey on Blockchain Interoperability: Past, Present, and Future Trends, ” 11 2022

    2022

  38. [46]

    SoK: Communication Across Distributed Ledgers,

    A. Zamyatin, M. Al-Bassam, D. Zindros, E. Kokoris-Kogias, P. Moreno-Sanchez, A. Kiayias, and W. J. Knottenbelt, “SoK: Communication Across Distributed Ledgers, ” tech. rep., 2019

    2019

  39. [47]

    Inter blockchain communication: A survey,

    I. A. Qasse, M. A. Talib, and Q. Nasir, “Inter blockchain communication: A survey, ” inACM International Conference Proceeding Series, Association for Computing Machinery, 10 2019

    2019

  40. [48]

    S. K. Niranjan, REVA University, Institute of Electrical, E. E. B. Section, Institute of Electrical, and E. Engineers,Proceedings of the International Conference on Smart Technologies in Computing, Electrical and Electronics (ICSTCEE 2020) : October 9-10, 2020, Virtual Confere...

    2020

  41. [49]

    Towards Blockchain Interoperability,

    S. Schulte, M. Sigwart, P. Frauenthaler, and M. Borkowski, “Towards Blockchain Interoperability, ” inBusiness Process Management: Blockchain and Central and Eastern Europe Forum: BPM 2019 Blockchain and CEE Forum, Vienna, Austria, September 1–6, 2019, Proceedings 17, pp. 3–10, 2019

    2019

  42. [50]

    Toward an Interoperability Architec- ture for Blockchain Autonomous Systems,

    T. Hardjono, A. Lipton, and A. Pentland, “Toward an Interoperability Architec- ture for Blockchain Autonomous Systems, ”IEEE Transactions on Engineering Management, vol. 67, pp. 1298–1309, 10 2020

    2020

  43. [51]

    About Blockchain Interoperability,

    P. Lafourcade and M. Lombard-Platet, “About Blockchain Interoperability, ” tech. rep., Université Clermont Auvergne, 2020

    2020

  44. [52]

    Attacks Against Cross-Chain Systems and Defense Approaches: A Contemporary Survey,

    L. Duan, Y. Sun, W. Ni, S. Member, W. Ding, J. Liu, and W. Wang, “Attacks Against Cross-Chain Systems and Defense Approaches: A Contemporary Survey, ”IEEE, 2023

    2023

  45. [53]

    Towards Atomic Cross- Chain Token Transfers: State of the Art and Open Questions within TAST,

    M. Borkowski, D. Mcdonald, C. Ritzer, and S. Schulte, “Towards Atomic Cross- Chain Token Transfers: State of the Art and Open Questions within TAST, ” tech. rep., TU Wien, 2018

    2018

  46. [54]

    Wrapping trust for interoperability: A preliminary study of wrapped tokens,

    G. Caldarelli, “Wrapping trust for interoperability: A preliminary study of wrapped tokens, ” 10 2022

    2022

  47. [55]

    Cross-Blockchain Technologies: Review, State of the Art, and Out- look,

    M. Borkowski, P. Frauenthaler, M. Sigwart, T. Hukkinen, H. Hladk ´y, and S. Schulte, “Cross-Blockchain Technologies: Review, State of the Art, and Out- look, ” tech. rep., TU Wien, 2019

    2019

  48. [56]

    Cross-Chain Deals and Adversarial Com- merce,

    M. Herlihy, B. Liskov, and L. Shrira, “Cross-Chain Deals and Adversarial Com- merce, ” inProceedings of the VLDB Endowment, vol. 13, pp. 100–113, 2019

    2019

  49. [57]

    Anonymous Multi-Hop Locks for Blockchain Scalability and Interoperability,

    G. Malavolta, P. Moreno-Sanchez, C. Schneidewind, A. Kate, and M. Maffei, “Anonymous Multi-Hop Locks for Blockchain Scalability and Interoperability, ” inNetwork and Distributed System Security Symposium (NDSS), 2019

    2019

  50. [58]

    Universal Atomic Swaps: Secure Exchange of Coins Across All Blockchains,

    S. A. K. Thyagarajan, G. Malavolta, and P. Moreno-Sanchez, “Universal Atomic Swaps: Secure Exchange of Coins Across All Blockchains, ” in2022 IEEE Sympo- sium on Security and Privacy (SP), pp. 1299–1316, 2022

    2022

  51. [59]

    FlyClient: Super-Light Clients for Cryptocurrencies,

    B. Bünz, L. Kiffer, L. Luu, and M. Zamani, “FlyClient: Super-Light Clients for Cryptocurrencies, ” in2020 IEEE Symposium on Security and Privacy (SP), pp. 928– 946, 2020

    2020

  52. [60]

    Non-Interactive Proofs of Proof-of-Work,

    A. Kiayias, A. Miller, and D. Zindros, “Non-Interactive Proofs of Proof-of-Work, ” inFinancial Cryptography and Data Security (FC), vol. 12059 ofLNCS, pp. 505–522, Springer, 2020

    2020

  53. [61]

    Alba: The Dawn of Scalable Bridges for Blockchains,

    G. Scaffino, L. Aumayr, M. Bastankhah, Z. Avarikioti, and M. Maffei, “Alba: The Dawn of Scalable Bridges for Blockchains, ” inNetwork and Distributed System Security Symposium (NDSS), 2025

    2025

  54. [62]

    zkBridge: Trustless Cross-Chain Bridges Made Practical,

    T. Xie, J. Zhang, Z. Cheng, F. Zhang, Y. Zhang, Y. Jia, D. Boneh, and D. Song, “zkBridge: Trustless Cross-Chain Bridges Made Practical, ” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 3003–3017, ACM, 2022

    2022

  55. [63]

    XCLAIM: Trustless, Interoperable, Cryptocurrency-Backed Assets,

    A. Zamyatin, D. Harz, J. Lind, P. Panayiotou, A. Gervais, and W. Knottenbelt, “XCLAIM: Trustless, Interoperable, Cryptocurrency-Backed Assets, ” in2019 IEEE Symposium on Security and Privacy (SP), pp. 193–210, 2019

    2019

  56. [64]

    SmartAxe: De- tecting Cross-Chain Vulnerabilities in Bridge Smart Contracts via Fine-Grained Static Analysis,

    Z. Liao, Y. Nan, H. Liang, S. Hao, J. Zhai, J. Wu, and Z. Zheng, “SmartAxe: De- tecting Cross-Chain Vulnerabilities in Bridge Smart Contracts via Fine-Grained Static Analysis, ” inProceedings of the 2024 ACM Joint European Software Engi- neering Conference and Symposium on the...

    2024

  57. [65]

    Near protocol

    “Near protocol. ” https://near.org/, 2025. Accessed: 2025-05-21. Official website of NEAR Protocol, a scalable, developer-friendly Layer 1 blockchain platform utilizing sharding (Nightshade) and a unique consensus mechanism (Doomslug) to support decentralized applications and ...

    2025

  58. [66]

    ” https://aptosfoundation.org/, 2025

    “Aptos. ” https://aptosfoundation.org/, 2025. Accessed: 2025-05-21. Official web- site of Aptos, a high-performance Layer 1 blockchain developed by former Meta engineers. Aptos leverages the Move programming language and the Block-STM parallel execution engine to achieve high ...

    2025

  59. [67]

    ” https://sui.io/, 2025

    “Sui. ” https://sui.io/, 2025. Accessed: 2025-05-21. Official website of Sui, a high- performance Layer 1 blockchain designed for scalability and low latency. Sui utilizes the Move programming language and features an object-centric data model, enabling parallel transaction ex...

    2025

  60. [68]

    Cosmwasm

    “Cosmwasm. ” https://cosmwasm.com/, 2025. Accessed: 2025-05-21. Official web- site of CosmWasm, a WebAssembly-based smart contract platform designed for Poupak Azad, Jiahua Xu, Yebo Feng, Preston Strowbridge, and Cuneyt Gurcan Akcora the Cosmos ecosystem, enabling secure, inte...

    2025

  61. [69]

    ” https://base.org/, 2025

    “Base. ” https://base.org/, 2025. Accessed: 2025-05-21. Official website of Base, a secure, low-cost, builder-friendly Ethereum Layer 2 (L2) blockchain incubated by Coinbase. Base is designed to bring the next billion users onchain by offering fast transactions and low fees. I...

    2025

  62. [70]

    ” https://celo.org/, 2025

    “Celo. ” https://celo.org/, 2025. Accessed: 2025-05-21. Official website of Celo, a mobile-first, carbon-negative blockchain platform that transitioned from an independent Layer 1 to an Ethereum Layer 2 solution. Celo focuses on real-world applications, offering low-cost trans...

    2025

  63. [71]

    Litecoin

    “Litecoin. ” https://litecoin.org/, 2025. Accessed: 2025-05-21. Official website of Litecoin, a peer-to-peer cryptocurrency enabling instant, near-zero cost pay- ments to anyone in the world. Litecoin is an open-source, global payment network that is fully decentralized withou...

    2025

  64. [72]

    Blocknet

    “Blocknet. ” https://blocknet.co/, 2025. Accessed: 2025-05-21. Official website of Blocknet, a decentralized interoperability protocol that enables communication, exchange, and service delivery between different blockchains through a cross- chain architecture

    2025

  65. [73]

    Colossusxt

    “Colossusxt. ” https://www.colossusxt.io/, 2025. Accessed: 2025-05-21. Official website of ColossusXT, a community-oriented, energy-efficient cryptocurrency focused on decentralization, privacy, and real-world implementation

    2025

  66. [74]

    Terra blockchain

    “Terra blockchain. ” https://www.terra.money/, 2025. Accessed: 2025-05-21. Offi- cial website of Terra, an open-source blockchain protocol that supports algorith- mic stablecoins and decentralized applications. Terra experienced a significant collapse in May 2022, leading to t...

    2025

  67. [75]

    The complete platform for onchain finance - wormhole

    “The complete platform for onchain finance - wormhole. ” https://wormhole.com/ institutions, 2025. Accessed: 2025-06-02

    2025

  68. [76]

    Bridges | flow developer portal

    “Bridges | flow developer portal. ” https://developers.flow.com/ecosystem/bridges,

  69. [77]

    Cardano

    “Cardano. ” https://cardano.org/, 2025. Accessed: 2025-05-21. Official website of Cardano, a decentralized proof-of-stake blockchain platform built on peer- reviewed research, designed for secure and scalable smart contracts and decen- tralized applications

    2025

  70. [78]

    What is IBC?

    Cosmos Developer Portal, “What is IBC?. ” https://tutorials.cosmos.network/ academy/3-ibc/1-what-is-ibc.html, 2024. Accessed: 2025-04-24

    2024

  71. [79]

    Ibc/tao - clients - developer portal

    “Ibc/tao - clients - developer portal. ” https://tutorials.cosmos.network/academy/3- ibc/4-clients.html, 2025. Accessed: 2025-06-02

    2025

  72. [80]

    Trustless interoperability between rollups: Landscape, constructions, and chal- lenges

    “Trustless interoperability between rollups: Landscape, constructions, and chal- lenges. ” https://medium.com/1kxnetwork/trustless-interoperability-between- rollups-landscape-constructions-and-challenges-8ff195ea92cc, 2024. Accessed: 2025-06-02

    2024

  73. [81]

    Blockchain scaling using rollups: A comprehensive survey,

    L. T. Thibault, T. Sarry, and A. S. Hafid, “Blockchain scaling using rollups: A comprehensive survey, ”IEEE Access, vol. 10, pp. 93039–93054, 2022

    2022

  74. [82]

    Axelar network

    “Axelar network. ” https://axelar.network/. Accessed: 2025-04-24

    2025

  75. [83]

    Layerzero protocol

    LayerZero Foundation, “Layerzero protocol. ” https://docs.layerzero.network/v2/ developers/solana/getting-started, 2025. Accessed: 2025-04-24

    2025

  76. [84]

    Celer cbridge

    “Celer cbridge. ” https://cbridge.celer.network/. Accessed: 2025-04-24

    2025

  77. [85]

    Bnb chain

    “Bnb chain. ” https://www.bnbchain.org/, 2025. Accessed: 2025-05-21. Official website of BNB Chain, a decentralized blockchain ecosystem supporting smart contracts and decentralized applications (dApps)

    2025

  78. [86]

    Bridging the gap: Ethereum-binance smart chain bridge (eth-bep)

    “Bridging the gap: Ethereum-binance smart chain bridge (eth-bep). ” https://www. binance.com/en/square/post/891550, 2023. Accessed: 2025-06-02

    2023

  79. [87]

    Osmosis

    “Osmosis. ” https://osmosis.zone/, 2025. Accessed: 2025-05-21. Official website of Osmosis, a decentralized exchange (DEX) and Layer 1 blockchain in the Cosmos ecosystem, enabling cross-chain asset swaps and liquidity provision through the Inter-Blockchain Communication (IBC) protocol

    2025

  80. [88]

    Cronos

    “Cronos. ” https://cronos.org/, 2025. Accessed: 2025-05-21. Official website of Cronos, an open-source, EVM-compatible Layer 1 blockchain developed by Crypto.com. Built on the Cosmos SDK and powered by Ethermint, Cronos sup- ports the Inter-Blockchain Communication (IBC) proto...

    2025

  81. [89]

    Gravity bridge

    “Gravity bridge. ” https://www.gravitybridge.net/, 2025. Accessed: 2025-05-21. Official website of Gravity Bridge, a decentralized, neutral Cosmos SDK-based blockchain facilitating trustless interoperability between Ethereum and Cosmos ecosystems through the Inter-Blockchain C...

    2025

  82. [90]

    Exploring cross-chain solutions: How to bridge into the cosmos ecosystem

    “Exploring cross-chain solutions: How to bridge into the cosmos ecosystem. ” https://www.axelar.network/blog/cosmos-bridge-explained, 2023. Accessed: 2025-06-02

    2023

  83. [91]

    Fantom

    “Fantom. ” https://fantom.foundation/, 2025. Accessed: 2025-05-21. Official web- site of Fantom, a high-performance, scalable, and secure smart-contract platform designed for decentralized applications (dApps) and digital assets

    2025

  84. [92]

    debridge finance

    deBridge Foundation, “debridge finance. ” https://debridge.finance, 2025. Accessed: 2025-04-24

    2025

  85. [93]

    Polkadot

    “Polkadot. ” https://polkadot.com/, 2025. Accessed: 2025-05-21. Official website of Polkadot, a scalable, interoperable, and secure multi-chain blockchain platform designed to connect various blockchains into a unified network

    2025

  86. [94]

    Introduction to xcm (cross-consensus messaging)

    Polkadot Documentation, “Introduction to xcm (cross-consensus messaging). ” https://docs.polkadot.network/develop/interoperability/intro-to-xcm/, 2025. Ac- cessed: 2025-04-24. Hedge Funds on a Swamp: Analyzing Patterns, Vulnerabilities, and Defense Measures in Blockchain Bridg...

    2025

  87. [2025]

    Accessed: 2025-06-02

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.