Skip to content
DeFi Reference

Bridge hacks — Wormhole, Ronin, Nomad, Multichain, Harmony, Orbit

1. TL;DR

Section titled “1. TL;DR”

Between February 2022 and January 2024, six bridge incidents alone accounted for well over $1.3 billion in losses, and — as Gnosis founder Martin Köppelmann observed of bridges generally — “historically many bridge hacks did not have their root cause in e.g. committees getting compromised but instead simply in smart contract bugs” (ethresear.ch, 2023-01; see /cross-chain/bridge-designs/). Wormhole and Nomad prove that point directly: both lost hundreds of millions to code that skipped verification it was supposed to perform, not to anyone actually corrupting the trust model’s signers. Ronin, Harmony, and Orbit instead validate the opposite failure mode — attackers who patiently compromised enough private keys or multisig signers to forge legitimate-looking withdrawals — while Multichain shows a third path entirely: a bridge can fail catastrophically even without an external attacker, if its operational keys are concentrated in one person who disappears.

2. Explain it simply

Section titled “2. Explain it simply”

Analogy

Section titled “Analogy”

A bridge’s security is like a bank vault with several possible failure modes, and each hack here is a different one: Wormhole and Nomad are a guard who forgot to actually check the ID at the door, so anyone with a photocopy walked straight through; Ronin, Harmony, and Orbit are thieves who patiently stole or copied enough of the vault’s several keys to open it the “legitimate” way; and Multichain is a vault whose only keyholder vanished, taking the only working key with him, so nobody — honest or not — could tell whether what happened next was theft or an inside job.

ELI5

Section titled “ELI5”

When people say a bridge got “hacked,” it almost always means one of two things: either the computer program that checks “did this really happen on the other blockchain?” had a bug that let it say yes to something fake, or the small group of people (or their private keys) trusted to approve transfers got compromised, so an attacker could get real approvals for fake withdrawals. A third, rarer failure is when the bridge depends on one person or company behind the scenes, and something happens to them — an arrest, a disappearance — that makes nobody able to say for sure what happened to the money.

Step-by-step walkthrough

Section titled “Step-by-step walkthrough”

Scenario: the Wormhole exploit of 2 February 2022, a bug-in-the-verification-code failure (not a signer-corruption failure).

  1. Before (state: Wormhole’s Ethereum-side contract holds ETH backing 120,000 wrapped ETH already minted on Solana). Wormhole’s Solana program should accept a mint instruction only with a valid set of guardian signatures over the corresponding Ethereum lock event.
  2. The bug. The signature-verification function used a deprecated command to check a companion Secp256k1 verification instruction had run earlier in the same transaction, by inspecting Solana’s “Instructions” sysvar account.
  3. The forge. The attacker passed in a fake account merely looking like the Instructions sysvar — the deprecated check didn’t confirm it was the real, protected address, so it accepted forged data as legitimate verification (Halborn, fetched 2026-08-30).
  4. The mint. With verification bypassed, the attacker minted 120,000 wETH on Solana with no corresponding ETH ever locked on Ethereum.
  5. After (state: 120,000 wETH exists with zero backing, $326M at the time). Jump Crypto, parent of developer Certus One, replaced the 120,000 ETH from its own funds within days to make the bridge whole.

Common misconceptions

Section titled “Common misconceptions”
  • Myth: These were all cases of “hackers stealing crypto keys.” Reality: Wormhole and Nomad required no stolen keys — the code accepted invalid proofs because a verification step was broken or skipped entirely.
  • Myth: A hack this size requires a sophisticated, novel technique. Reality: Once Nomad’s flaw was public, Rekt News described the aftermath as “staying true to DeFi Principles, this hack was permissionless — anyone could join in” (via Halborn, fetched 2026-08-30) — hundreds of wallets copy-pasted the same exploit with their own address substituted in.
  • Myth: Multisig bridges are safe as long as the threshold isn’t 1-of-n. Reality: Ronin’s 5-of-9 threshold was defeated by compromising five keys — four from one operator, and a fifth via an allowlist permission that was never revoked (Halborn, fetched 2026-08-30).
  • Myth: A bridge exploit always means an external attacker. Reality: Multichain’s July 2023 collapse followed its CEO’s arrest, after which its MPC node servers — tied to his personal cloud account — could no longer be reached by the team at all (fetched 2026-08-30).
  • Myth: Post-mortems always agree on root cause quickly. Reality: Orbit Chain’s loss was attributed by outside analysts to compromised keys within days, while Orbit’s own team said only it was working with law enforcement — “believed to be” causes can outpace confirmed findings.

If you only remember one thing

Section titled “If you only remember one thing”

Every large bridge hack is either a proof that failed to check something it should have (Wormhole, Nomad), keys that fell into the wrong hands (Ronin, Harmony, Orbit), or a bridge whose trust rested on one unreachable party (Multichain) — no amount of “n” in a k-of-n threshold protects against the second or third if k is small or concentrated enough.

3. How it works

Section titled “3. How it works”

Verification-bug failures: Wormhole and Nomad

Section titled “Verification-bug failures: Wormhole and Nomad”

Wormhole’s guardian network (see /cross-chain/bridge-designs/) requires 13-of-19 guardian signatures over a Verifiable Action Approval before Solana mints wrapped assets. The attacker never touched a guardian key. Instead, the Solana program’s verify_signatures instruction used a deprecated method — load_instruction_at — to confirm a prior Secp256k1-signature-check had run in the same transaction, by reading Solana’s protected “Instructions” sysvar account, without verifying that account was genuinely the sysvar rather than an attacker-supplied lookalike; Halborn states plainly “the use of deprecated functions is poor code security and cost the project over $300 million” (fetched 2026-08-30). The attacker supplied a forged account, the check passed, and the program treated 120,000 ETH of signatures as verified when none existed.

Nomad’s failure, six months later, arose from a routine upgrade rather than a forged input. Its Replica contract verifies incoming messages against a “trusted root” inside _process(). During an upgrade, the trusted root was initialized to 0x00, which — per Immunefi — “matches the value for an untrusted root, so all messages are automatically viewed as proven” (fetched 2026-08-30). Any message now passed verification, since the value meaning “nothing proven yet” was indistinguishable from “this root has been proven.” Once one attacker published a working exploit, anyone could copy it with their own address substituted — “anybody can simply change the message to create a new unused one and resubmit it” (Immunefi, fetched 2026-08-30) — why Nomad’s ~$190M loss (as of 2022-08) involved hundreds of addresses rather than one attacker.

Signer-compromise failures: Ronin, Harmony, Orbit

Section titled “Signer-compromise failures: Ronin, Harmony, Orbit”

Ronin’s bridge used a 5-of-9 validator threshold; the attacker needed only five. Halborn states the attacker “gained control of four validators controlled by Sky Mavis and a third-party Axie DAO validator that signed their malicious transactions” (fetched 2026-08-30). The fifth signature came through a November 2021 allowlist letting Sky Mavis sign on Axie DAO’s behalf that “was never revoked” after expiring, obtained via a gas-free RPC node Sky Mavis operated. Total losses: ~173,600 ETH and 25.5M USDC, roughly $625M at the time (as of 2022-03).

Harmony’s Horizon bridge lost ~$100M on 23 June 2022 to a multisig key compromise; Harmony’s own statement said only it had “identified a theft occurring this morning on the Horizon bridge amounting to approx. $100MM” and begun working with authorities (quoted via CoinDesk/CNBC, fetched 2026-08-30). The FBI later attributed the theft to the Lazarus Group, also tied to Ronin.

Orbit Chain lost ~$81–82M on 31 December 2023 across ETH, USDT, USDC, WBTC and DAI. Halborn states the incident “is believed to be the result of compromised private keys,” cautioning the protocol’s multisig configuration wasn’t fully disclosed (fetched 2026-08-30). Researcher Taylor Monahan called the pattern methodical and consistent with prior Lazarus Group activity — attribution here is analyst opinion, not confirmed.

Operator failure without an external attacker: Multichain

Section titled “Operator failure without an external attacker: Multichain”

Multichain’s July 2023 collapse doesn’t fit the verification-bug or signer-compromise pattern cleanly. Its CEO, “Zhaojun,” was detained by Chinese police in May 2023 along with his computers, phones, and hardware wallets; because Multichain’s MPC (multi-party computation) node servers ran under his personal cloud account, “nobody could access the MPC servers in order to resolve the issues” once he was unreachable (reporting on Multichain’s statement, fetched 2026-08-30). Roughly $125–126M in user funds were moved to unknown addresses in early July, which the team said were transferred by Zhaojun’s sister into wallets she controlled before she too was detained. Multichain shut down entirely, citing lack of operational access and funds. Whether this counts as an “exploit” is genuinely ambiguous — best understood as a single-operator custody failure producing the same outcome as a technical exploit.

A rough taxonomy of root causes

Section titled “A rough taxonomy of root causes”
Root-cause categoryIncidentsWhat actually failed
Signature/proof verification bugWormhole, NomadCode accepted invalid or absent proofs as valid
Compromised or over-privileged signersRonin, Harmony, OrbitEnough legitimate-looking signatures obtained to pass a real k-of-n check
Single-operator custody failureMultichainSole keyholder of MPC infrastructure became unreachable

4. Worked numeric example

Section titled “4. Worked numeric example”

Comparing the six incidents by loss and threshold, illustrating why “13-of-19” or “5-of-9” alone tells you nothing about which failure mode actually occurred:

IncidentDateAmount (approx., as of incident date)Threshold modelRoot cause
Wormhole2022-02-02$326M (120,000 wETH)13-of-19 guardian signaturesVerification bug — no signatures actually needed
Ronin2022-03-23 (discovered 6 days later)$625M (173,600 ETH + 25.5M USDC)5-of-9 validator signatures5 legitimate-looking signatures obtained via unrevoked allowlist + compromised keys
Nomad2022-08-01$190MOptimistic, fraud-proof watchersVerification bug — zeroed trusted root, no proof actually required
Harmony2022-06-23$100MMultisig (reported 2-of-5 in secondary sources)Compromised multisig keys
Multichain2023-07-07 (onset)$125–126MMPC nodes under single operatorOperator (CEO) detained; sole access to MPC infrastructure lost
Orbit Chain2023-12-31$81–82MMultisigBelieved compromised private keys (unconfirmed configuration)

The two largest losses — Ronin at $625M and Wormhole at $326M — came from opposite failure modes despite both nominally using “k-of-n signatures”: Ronin’s threshold was real and defeated with real signatures, while Wormhole’s threshold was never tested because verification could be tricked into passing with zero.

5. Where it’s used

Section titled “5. Where it’s used”

Ethereum

Section titled “Ethereum”
  • Wormhole — 19-guardian network; its Feb 2022 exploit lived in the Solana-side program, but the locked ETH backing the wrapped supply sat on Ethereum. wormhole.com
  • Nomad — optimistic, fraud-proof bridge connecting Ethereum to Moonbeam, Avalanche, Milkomeda, and Evmos; effectively ceased operating after its Aug 2022 exploit.
  • Ronin — an Ethereum-sidechain bridge for Axie Infinity; the Ethereum-side contract is where forged withdrawal signatures were submitted.
  • Harmony (Horizon Bridge) — connected Harmony’s chain to Ethereum and BNB Chain; the Ethereum-side multisig was the point of compromise.
  • Multichain — formerly the largest multi-chain router by chain count; ceased operations entirely after July 2023.
  • Orbit Chain (Orbit Bridge) — a Korea-based multi-chain bridge connecting Ethereum, BNB Chain, Polygon, Klaytn, and others.

Solana

Section titled “Solana”
  • Wormhole / Portal — the chain on which the exploited program ran; attestation and mint logic are symmetric to the Ethereum side, but this bug was Solana-program-specific. wormhole.com
  • n/a — no Solana-native bridge incident of comparable scale documented in these sources. None of Ronin, Nomad, Harmony, Multichain, or Orbit had a Solana-side component.

6. Risks, attacks, and incidents

Section titled “6. Risks, attacks, and incidents”

This entire page is a risk-and-incident catalog; the cross-cutting lessons:

  • Deprecated or ad-hoc verification code is as dangerous as a missing check. Wormhole’s bug was not “no signature check” but one that could be fed a forged input; treat any cryptographic-claim verification as security-critical even when it looks like routine plumbing.
  • Default/sentinel values in trust-critical state are a distinct bug class. Nomad’s 0x00 trusted root collided with the sentinel meaning “not yet proven” — any system using one value for both “uninitialized” and “de facto trusted” is exposed to this error class.
  • Unrevoked permissions are a silent, compounding attack surface. Ronin’s fifth signature existed only because a November 2021 allowlist grant was never revoked; the compromise itself happened four months later.
  • Concentrating operational access in one person is itself a single point of failure, independent of code quality — Multichain’s collapse required no attacker at all.
  • North Korea-linked actors (Lazarus Group) are directly implicated by U.S. authorities in Ronin and Harmony, and suspected in Orbit Chain — a documented, recurring participant in bridge exploits (see /security/trusted-hardware-and-threat-models/).

7. Open problems

Section titled “7. Open problems”
  • How to detect a copy-paste-exploitable bug before production. Nomad’s flaw passed whatever review it got during a “routine upgrade”; that it was trivial to replicate once known, but not caught beforehand, remains an open audit-methodology question.
  • How to bound custody risk when a bridge depends on any single jurisdiction or individual. Multichain’s failure — funds inaccessible because one person was detained — has no clean technical mitigation; MPC and multisig designs reduce but don’t eliminate this if access still concentrates around one operator.
  • Whether “additive security” (Hashi-style header aggregation, see /cross-chain/bridge-designs/) would have prevented any of these six incidents. Aggregating bridges as header oracles addresses committee-compromise risk more than implementation-bug risk (Wormhole, Nomad) or single-operator risk (Multichain).
  • Attribution speed vs. accuracy. Several incidents (Orbit especially) show a gap between fast “believed to be” attributions from security firms and slower official confirmations — a documented pattern, not a solved problem.

8. Ethereum vs Solana

Section titled “8. Ethereum vs Solana”
AspectEthereumSolana
Bridges with major documented lossesWormhole (Ethereum-side lock), Nomad, Ronin, Harmony, Multichain, Orbit — all Ethereum-connectedWormhole only, and the exploited code was Solana-side
Dominant failure mode observedMixed: verification bugs (Wormhole, Nomad) and signer compromise (Ronin, Harmony, Orbit)Single incident (Wormhole) — a deprecated-function verification bug
Total documented losses in this set (as of 2024-01)≈$1.05B across Nomad, Ronin, Harmony, Multichain, Orbit combined$326M (Wormhole, program-side loss, backed by Ethereum-side collateral)
State-actor attributionRonin, Harmony (Lazarus Group, confirmed by FBI); Orbit (suspected)None documented in these sources for the Wormhole incident

The pattern is the same across chains: which chain the exploited code runs on is almost incidental to which chain’s assets get lost, since backing collateral typically sits on the more liquid side (usually Ethereum) regardless of where the bug or key lived. Solana’s appearance here is as the execution environment for someone else’s bug, not a Solana-specific failure mode.

9. Reference doc

Section titled “9. Reference doc”

The reference

Section titled “The reference”

Nomad Bridge Hack: Root Cause Analysis — Nomad, 2 August 2022. medium.com/nomad-xyz-blog

Summary of the reference

Section titled “Summary of the reference”

Nomad’s own post-mortem traces the exploit to a single line changed during a routine contract upgrade: the Replica contract’s trusted root, used inside _process() to validate that an incoming message’s Merkle proof matches a previously-proven root, was initialized to 0x00 rather than to a genuinely proven root value. Because the same 0x00 value was also the contract’s convention for “this root has not been proven yet,” the verification logic that was supposed to reject unproven messages instead treated every message as already proven, regardless of whether any valid Merkle proof for it existed. Immunefi’s independent technical analysis of the same incident (accessed for this page, since Nomad’s own post could not be directly fetched at time of writing) confirms the mechanism precisely: the _process() function’s assertion checking message validity effectively became a no-op, so “the transactions to the bridge only called _process() within Replica.sol without proving validity” (fetched 2026-08-30).

What made the incident unusually chaotic compared to a typical single-attacker exploit was the bug’s trivial replicability: once the first exploit transaction was visible on-chain, anyone could copy it, substitute their own address as the recipient, and resubmit it, since the verification bypass applied to any message, not one crafted by a single sophisticated attacker. This produced the “permissionless” free-for-all Rekt News described, with hundreds of distinct addresses — some clearly unsophisticated, copying transactions with minimal modification — participating in draining the roughly $190M held by the bridge (as of 2022-08).

Key quotes

Section titled “Key quotes”

“The Nomad bridge was hacked on August 1st, 2022, and $190m of locked funds were drained.” (Immunefi analysis, Introduction)

“A routine upgrade on the implementation of one of Nomad’s proxy contracts marked a zero hash value as a trusted root, which allowed messages to get automatically proved.” (Immunefi analysis, Root Cause)

“Staying true to DeFi Principles, this hack was permissionless — anyone could join in.” (Rekt News, quoted in Immunefi analysis)

“Anybody can simply change the message to create a new unused one and resubmit it.” (Immunefi analysis, Root Cause)

How to read the original

Section titled “How to read the original”

Background needed: what a Merkle-proof-based message-passing bridge verifies (a proof that a message is included in a tree whose root the destination chain has agreed to trust), and roughly how an optimistic bridge’s “trusted root” differs from a light client’s directly-verified header. Skip a close reading of the exact Solidity line numbers in third-party technical write-ups on a first pass — the conceptual bug (a sentinel value for “unproven” colliding with a value that bypasses proof-checking) is the entire story. The hardest part to internalize is why this was worse than a normal single-exploit bug: because the flaw applied to any message rather than requiring an attacker to construct one specific forged proof, the exploit had none of the scarcity that normally limits how much of a hack’s proceeds get claimed by copycats before white-hats or the protocol itself can react.

What changed since

Section titled “What changed since”
  • Nomad’s incident, alongside Wormhole’s, is the primary real-world evidence cited in later cross-chain design literature (including Hashi and EIL, see /cross-chain/bridge-designs/ and /cross-chain/cross-l2-interop/) for why bridge security should not be evaluated only by its stated trust model (multisig, optimistic, light client) but by its actual implementation.
  • CCTP’s native burn-and-mint model (Circle, live and expanding as of 2026-08) sidesteps the entire class of “locked collateral drained by a code bug” failure that Wormhole and Nomad both represent, by never locking a fungible pool of collateral that a verification bypass could unlock.
  • Bridge insurance and bounty practices shifted visibly after this cluster of incidents — Wormhole’s $10M bounty offer to its attacker and Jump Crypto’s full-loss backstop became reference points cited in later incident responses, including Multichain’s and Orbit’s own (unsuccessful) attempts to negotiate with attackers.

Secondary references

Section titled “Secondary references”
  1. Explained: The Ronin Hack (Halborn, accessed 2026-08-30) — read for the clearest available breakdown of the allowlist-permission mechanism behind Ronin’s fifth compromised signature.
  2. Explained: The Wormhole Hack (Halborn, accessed 2026-08-30) — read for the specific deprecated-sysvar-function mechanism, since Wormhole’s own incident report could not be directly retrieved for this page.
  3. Explained: The Orbit Bridge Hack (Halborn, accessed 2026-08-30) — read if you want the most complete public account of Orbit Chain’s loss, while noting the root cause remains “believed to be” rather than officially confirmed in Orbit’s own statements.
  4. Hashi — A principled approach to bridges (Köppelmann, ethresear.ch, 2023-01) — read for the design-level argument (in /cross-chain/bridge-designs/) that most of the incidents on this page are implementation failures, not trust-model failures, and what that implies for how to defend against them.

10. Sources

Section titled “10. Sources”