1. What is a Bridge Legally?

A bridge is NOT a blockchain. It is an escrow custodian + messaging service.

Three Models - Liability Differs:

1. Lock-Mint (Wormhole, Ronin): Lock ETH on Chain A, mint wETH on Chain B. You are a custodian. If locked assets stolen, you have custodial liability like a bank.
2. Liquidity Pool (Multichain, Stargate): No minting, just pool rebalancing. You are an exchange/Market Maker.
3. Messaging Layer (LayerZero, CCIP, Axelar): You don't hold funds, you just attest "message is valid" via Verifier Network (DVN). If DVN is compromised, you are liable for negligent misrepresentation.

What Actually Breaks:

• Validator Collusion / Takeover: Bridge relies on quorum of 2/3 validator set to sign cross-chain messages. Validators whitelisted off-chain and receive modest fees. Attacker who bribes ≥2/3 can approve fraudulent exit proofs. This is what happened in Ronin - attacker took over 5 of 9 validators via phishing, went unnoticed for 6 days.
• Smart Contract Bug: Wormhole attacker exploited flaw in digital signature validation to steal $326M. Nomad had misconfigured trusted root, no fraud window.
• Key Person / Infrastructure: Multichain - human with server access got arrested, private keys lost. Bridge Loss: Ronin - leftover emergency access nobody revoked, Wormhole - signature bug in reviewed code, Nomad - one misconfigured trusted root.

2. Liability Frameworks Courts Are Applying

No single statute yet. Courts use 4 theories:

A. Contract - Is Terms of Service a Bailment Contract?
Most bridges ToS says "software provided as-is, no liability". Courts are striking this down as unfair when they market as secure custody. If bridge holds locked assets, it is bailee with duty of reasonable care.

B. Tort - Negligence in Security Design
Duty: Bridge operator holding $100M+ TVL owes duty of a professional custodian (like SWIFT operator). Breach: Failure to implement multisig, audit, bug bounty, time-locks.
Causation: Exploit was direct result of failure.

C. Fiduciary / Trust
If bridge markets "your assets are safe", some jurisdictions treat as constructive trust. Failure = breach of fiduciary duty.

D. Product Liability / Consumer Protection
Under EU Digital Services Act and US, bridge as software product with defect.

3. Landmark Case Laws - Now Forming Precedent

1. KelpDAO (Evercrest Technologies) v. LayerZero Labs Ltd. - Supreme Court of British Columbia - Filed Sept 2026 - $292M rsETH Exploit
The most important bridge liability case to date.

Facts: April 22, 2026 exploit - KelpDAO's rsETH bridge built on LayerZero infrastructure drained. KelpDAO says triggered broader run across DeFi.
KelpDAO's Claim: "The exploit was not a failure of KelpDAO's systems. It was a failure of LayerZero's own security infrastructure." Filing claims LayerZero reviewed and endorsed the 1-of-1 decentralized verifier network (DVN) configuration used by Unichain bridge that was exploited. "The exploit was a direct result of LayerZero's failures, including a failure to disclose weaknesses and risks inherent in LayerZero's own technology."
Defense: LayerZero CEO Pellegrino - configuration was user's choice, 1-of-1 DVN was documented as low security.
Legal Issue: Is messaging layer liable when it endorses insecure configuration? Court to decide if LayerZero is mere infrastructure (like TCP/IP) or security provider with duty to warn.
Outcome pending, but KelpDAO migrating to Chainlink's protocol signals shifting security expectations.

2. Ozys (Orbit Bridge) Operator Liability - South Korean Court - 2024 - $80.5M (110B Won)
South Korean court ruled Ozys, operator of cross-chain bridge Orbit Bridge, is liable for damages to a user following massive security breach. Court ruled bridge operator is liable, not just hacker.
Precedent: Marks significant legal development in country's approach to cryptocurrency platform accountability. Establishes operator has duty of care akin to electronic financial business under Electronic Financial Transactions Act. "As-is" clause invalid.

3. Multichain - US Bankruptcy + Singapore Liquidation - 2023-2024 - $126M + $63M USDC Freeze
A New York bankruptcy judge extended freeze on wallets holding $63M in stolen USDC stablecoins linked to collapse of cross-chain bridge Multichain, siding with Singapore-based liquidators seeking to recover assets under cross-border insolvency rules. Judge David S. Jones issued provisional order requiring stablecoin issuer Circle to maintain freeze on three Ethereum addresses until final hearing.
Holding: Cross-chain bridge assets are property of estate, not user's. Liquidators can get worldwide freeze under Chapter 15. Circle as issuer can be compelled to freeze even without privity.

4. Ronin Bridge - $625M - Sky Mavis Reimbursement Model
Sky Mavis, developer of Axie Infinity and operator of Ronin network, paused operations, raised $150M, reimbursed users, worked with FBI; North Korean attackers (Lazarus Group) never responded. Treasury linked attack to Lazarus.
Legal significance: No lawsuit by users succeeded because Sky Mavis voluntarily made whole. But established moral precedent: Wormhole users were made whole because Jump Crypto replaced ∼$325M; Ronin users reimbursed by Sky Mavis; Poly Network's attacker returned funds. Courts now ask: Did operator have insurance/treasury to make whole? If yes and they didn't, breach of good faith.

5. Wormhole - $326M - Jump Crypto Bailout - Feb 2022
Attacker exploited flaw in digital signature validation. Post-hack, Wormhole upgraded contract and resumed with same guardian set. Jump Crypto replenished 120k wETH from own capital. No litigation because made whole, but post-mortem used as standard of care: Signature verification bug in reviewed code = negligence, even if audited.

6. Nomad Bridge - $190M - "Copy-paste" Hack - Aug 2022
Single misconfigured trusted root, no fraud window, allowed anyone to copy original exploit. Class action filed in California (Barron v. Nomad) - alleging bridge marketed as decentralized and secure but had single point of failure. Settled confidentially, but court denied motion to dismiss on code-is-law grounds - code with bug is defective product.

7. Tulip Trading Ltd v. Bitcoin Association (UK Court of Appeal 2023) - Duty of Developers
Not bridge but relevant: Craig Wright's Tulip claimed developers owe fiduciary duty to recover stolen coins. Court of Appeal reversed dismissal, held arguable case that developers with control over code owe duty. If applied to bridge guardians who can upgrade contracts, they may owe duty to freeze and recover - same logic used in Multichain freeze order.

4. Who Bears Loss Under Current Law?

5. Compliance Checklist to Avoid Liability (If You Build/Use Bridge)

1. Do not use 1-of-1 DVN - Minimum 2-of-3 independent verifiers (Chainlink + LayerZero + self-run)
2. Time-lock + Fraud Window: All mint operations delayed 30 min with opt-out monitoring - Nomad failure was no fraud window.
3. Emergency Pause Controlled by Multisig of Users, Not Just Team
4. Insurance: TVL > $10M must have cover from Nexus Mutual / Chainlink / self-insurance fund - courts look for ability to make whole.
5. Clear Risk Disclosure: If you endorse config, document in writing: "This configuration provides no security against single verifier compromise" - LayerZero's failure to disclose is core of KelpDAO suit.
6. Bug Bounty > $1M - Shows reasonable care.

If you are dealing with a bridge loss now, the immediate steps courts have enforced: Get UETR/transaction hash, request freeze from stablecoin issuer (Circle/Tether) within 24 hrs (they comply under Multichain precedent), file police/FBI IC3, file in BC Supreme Court or Singapore if LayerZero/Multichain nexus - they have shown willingness to grant cross-border freeze.