Crypto bridge hacks: cross-chain exploits and their market effect
The essentials in 30 seconds
- A crypto bridge hack breaks the backing of tokens that moved between blockchains, as of October 2026.
- The Ronin Network exploit of 23 March 2022 took about $620 million.
- The company took 6 days to notice the theft, and the FBI attributed it to the Lazarus Group on 14 April 2022.
- Ronin reimbursed all affected users after raising additional venture capital.
- 4 checks help you size the risk before you bridge.
Crypto bridge hacks are cross-chain exploits: attackers drain the pooled assets that back tokens moving between blockchains. This page, current as of October 2026, explains the mechanics, walks through the documented Ronin case, and shows how a breach at one bridge can reach the wider market. It is a branch of the guide to crypto hacks and the crash.
On this page
Compare the EQOS Asia offers and request a 30-minute pre-diagnostic.
What is a crypto bridge, and why does it hold so much value?
A crypto bridge lets a holder move value from one blockchain to another. The common design locks the original coins in a pooled contract on the first chain and issues a copy, called a wrapped token, on the second. Every copy depends on the pool, so the pool grows as users bridge more and becomes a single target that holds the backing for many users at once.
That concentration explains why bridge breaches are large. A single compromised pool can hold the funds of thousands of users, and the stolen amount scales with the activity of the chain, not with the size of the attacker. The mechanics below show which parts of a bridge fail and why the market effect extends beyond the bridge itself.
How do crypto bridge hacks break the backing of tokens?
A bridge needs a rule that decides when coins are released: a group of validators who sign, a program that checks messages between chains, or a mix of both. An exploit targets that rule. If the attacker obtains enough signing power or fools the check, the pool releases coins without a matching deposit, and the copies on the other chain lose their backing.
The result is a gap between what the wrapped tokens promise and what the pool holds. The gap is public, because the ledger shows every balance, so the loss becomes visible quickly to anyone who looks. Holders then ask whether the wrapped token still redeems one for one, and that doubt is the first market effect of a bridge breach.
What happened in the Ronin bridge hack of 2022?
The Ronin Network bridge was compromised on 23 March 2022. Two transactions took 173,600 Ether and 25.5 million USDC, about $620 million in total, according to the Axie Infinity account on Wikipedia. The account says hackers compromised the Ronin Network and does not describe the technical method, so this page adds none.
Detection came late: it took the company 6 days to notice the hack. On 14 April 2022, the FBI said the Lazarus Group and APT38, both North Korean state-sponsored hacker groups, were responsible, and the US Treasury sanctioned the cryptocurrency address. Some of the funds were laundered through Tornado Cash.
Which crypto tokens lost value after the Ronin exploit?
The documented price effect sits in the game economy that relied on Ronin. The account says the hack further damaged the value of SLP, a token that had already crashed in February 2022, when it lost over 99% of its peak value. It gives no figures for the effect of the hack, so this page states none.
The lesson for a reader is about channels. A breach at the infrastructure that serves one ecosystem hits the tokens of that ecosystem first. Whether the shock reaches the wider crypto market then depends on how much value sits on the bridge, how many protocols accept its wrapped tokens, and how quickly the owner explains the loss.
How were users repaid after the crypto bridge breach at Ronin?
On 8 April 2022, the company said it expected to recover some of the funds, and that the recovery would take several years. It raised additional venture capital and reimbursed all users affected in the hack. The account consulted does not say how much has been recovered, so no recovery figure appears here.
The response follows a pattern also seen at exchanges: the owner makes users whole, publishes a timeline, and works with authorities. For a holder, the useful fact is that repayment came from new capital raised by the company. A bridge without that capacity leaves wrapped tokens unbacked, and holders carry the loss.
How can a crypto bridge hack spread to the wider market?
A bridge breach spreads through 4 links: the wrapped token falls below the price of the original coin, liquidity pools that hold the wrapped token lose depth, lenders that accept it as collateral face margin calls, and traders exit related tokens to cut risk. Each link adds selling pressure on thin order books.
The speed of the spread depends on how connected the bridge is. A bridge used by many protocols passes the shock across more of the market than a bridge used by one game. As of October 2026 the practical rule is to ask where a wrapped token is used as collateral before you decide how exposed you are to its bridge.
What can you check before using a crypto bridge?
Run 4 checks before you bridge. Find out who controls the signing rule and how many parties must agree. Read whether an independent review of the code is published and dated. Check how much value the pool holds relative to its usage. Decide how much you can leave on the other chain if the wrapped token stopped redeeming.
Teams in Singapore, ASEAN, and Hong Kong can add these checks to a counterparty review. A 30-minute pre-diagnostic with EQOS Asia scores your own case, and the Λ simulator lets you test a first version yourself. This page is general information, not investment advice, and its facts were consulted on 23 October 2026.
See also in this guide
Frequently asked questions
What is a crypto bridge hack?
A crypto bridge hack is an exploit that drains or fools the pool backing tokens that moved between blockchains. The wrapped tokens on the destination chain then lose their backing, and holders doubt that they still redeem one for one.
How large was the Ronin bridge hack?
The Ronin Network exploit of 23 March 2022 took 173,600 Ether and 25.5 million USDC, about $620 million. The company took 6 days to notice, and the FBI attributed the theft to the Lazarus Group on 14 April 2022.
Does a bridge hack crash the whole crypto market?
Not by itself. A bridge breach hits the tokens of its own ecosystem first. It reaches the wider market when many protocols accept the wrapped token as collateral and when thin order books amplify the selling. The 4 links on this page show how.
What should I check before bridging crypto?
Check who controls the signing rule, whether a dated independent code review is published, how much value the pool holds relative to its usage, and how much you can leave on the other chain. This page is general information, not investment advice.
Test your knowledge
1. What backs a wrapped token on a bridge?
- A pool of original coins
- A promise from the exchange
- The mining speed
Show the answer
A pool of original coins.
2. How long did Ronin take to notice its breach?
- 6 hours
- 6 days
- 6 weeks
Show the answer
6 days.
3. Who did the FBI attribute the Ronin theft to?
- A rival exchange
- A game studio
- The Lazarus Group
Show the answer
The Lazarus Group.
4. What did Ronin do for affected users?
- Reimbursed all of them
- Asked them to wait
- Closed the network
Show the answer
Reimbursed all of them.
5. Which link of the spread involves lenders?
- A new token name
- A change of logo
- Margin calls on collateral
Show the answer
Margin calls on collateral.
About the author
Stéphane Jambu
President, EQOS Forecast Asia
Stéphane Jambu leads EQOS Forecast Asia and works as a consultant in e-commerce, search visibility, and AI. LinkedIn profile
Sources: EQOS Asia contact page (eqos-asia.com/contact.html) and simulator (eqos-asia.com/simulator.html), en.wikipedia.org/wiki/Axie_Infinity, en.wikipedia.org/wiki/Ronin_Network, consulted on 23 October 2026. Page updated on 23 October 2026.