1. Why Cross-Chain is Riskier Than Single-Chain

On a single chain, 1 ETH = 1 ETH. On cross-chain, you lock ETH on Chain A and mint wrapped ETH on Chain B.[wETH]

If attacker drains 6,000 ETH from bridge reserves, 10,000 wETH still exists on other chain but only 4,000 ETH is left to redeem. The wrapped token becomes unbacked and worthless. This is why bridges are concentration risk.

5 Risk Dimensions:

A. Technical Risk - Smart Contract & Validation

• Signature verification bug: Wormhole Feb 2022 - $325M stolen via flaw on Solana side that allowed minting without lock
• Compromised validator keys: Ronin March 2022 - $540-625M drained after attackers obtained 5 of 9 validator keys
• Faulty upgrade: Nomad Aug 2022 - $190M copied hack after update made any message valid
• Single Verifier: New pattern - KelpDAO rsETH bridge ran 1-of-1 DVN, single verifier approved forged cross-chain message

B. Economic Risk - TVL Honeypot
Bridges lock billions. Ethena USDe risk assessment gave Economic Exposure 9/10 with $4.7B TVL - successful mint exploit could create unlimited tokens.

C. Operational Risk
Relayer network, off-chain indexing, and upgradeable contracts are single points of failure. Multichain hack July 2023 - $210M stolen across 8 chains after CEO detained and keys lost .

D. Compliance / AML Risk
Lazarus Group uses bridges to launder. In 2025 ByBit $1.5B hack, funds laundered via Chinese OTC + bridge protocols over 45-day cycle.
Treasury sanctioned Tornado Cash in Aug 2022 citing >$7B laundered including Ronin, Harmony, Nomad funds. Federal appeals court in late 2024 ruled OFAC overstepped by sanctioning immutable contracts, Treasury delisted it March 2025.

E. Legal / Counterparty Risk
Wrapped assets carry bridge failure risk, not blockchain risk. Minimizing bridging reduces exposure.

2. Case Laws - Who Pays When Bridge Fails?

1. KelpDAO vs LayerZero Labs - $292M rsETH Exploit [British Columbia, Filed Sep 2026]
Landmark ongoing case. KelpDAO's cross-chain bridge held ∼1/5th of rsETH supply. On April 18-22, 2026, attackers stole 116,500 rsETH worth $292M.
KelpDAO sued LayerZero and CEO Bryan Pellegrino, alleging undisclosed weaknesses in LayerZero protocol enabled exploit. Kelp alleges LayerZero signed off on exact 1-of-1 DVN setup that got drained. Case rewrites liability rules - is bridge infra provider liable for client's configuration?

2. Ozys / Orbit Bridge Operator Liable - South Korea 2024-2025
South Korean court ruled Ozys, operator of Orbit Bridge, liable for $80.5M hack [110B won loss]. Court ordered damages to user. First court in Asia to hold bridge operator directly liable for security breach, not just hacker.

3. Fantom Foundation vs Multichain - $2.1M Default Judgment [Jan 30, 2024]
After July 6 2023 Multichain hack, Fantom sued Multichain. Court granted $2.1M default judgment when Multichain failed to appear. Precedent for recovering from defunct bridge entities.

4. FTC vs Illusory Systems Inc. [Nomad Bridge] - Proposed Settlement 2024
FTC reached settlement with Nomad bridge operator after critical vulnerability introduced in June 2022 code update caused >$100M consumer losses. First FTC action treating bridge hack as consumer protection failure, not just code bug.

5. Gala Games vs pNetwork - $540M+ Liability Admission
pNetwork admitted liability after exploit. Demonstrates bridge wrapper providers can be sued for wrapped token depeg.

6. ByBit vs Lazarus Group / North Korea - 2025 Ongoing
ByBit pursuing legal freezing orders. When court orders assets frozen, custodian has legal obligation to comply - converts request into requirement.

3. Compliance Framework For Projects & Users

If you build with bridges:

1. Use intents architecture [Across Protocol model] - eliminates locked funds, primary cause of hacks
2. Require 2+ independent verifiers - never 1-of-1 DVN
3. Rate-limited withdrawals + 24h timelock on upgrades
4. Multiple independent audits + bug bounty >10% TVL
5. Legal: Terms must define if wToken is backed 1:1, who makes users whole. Wormhole users made whole because Jump Crypto replaced $325M; Ronin users reimbursed by Sky Mavis - but no legal guarantee unless contract says so.

If you are a user / treasury:

• Treat bridged assets as elevated hack risk, not same as native asset
• Check bridge trust model: IBC has zero exploits since launch across 115 chains; external-validator bridges produced most largest losses
• Avoid bridging unless necessary; use native swaps where possible
• For India: FIU-IND considers cross-chain swaps as crypto transfer under PMLA - maintain trail for >Rs 10L transactions.