The $292 million Kelp DAO exploit shows why crypto bridges are still one of the industry's weakest links

The $292 million exploit tied to KelpDAO is the latest in a long line of crypto bridge hacks, underscoring how the systems designed to connect blockchains have become some of the easiest ways to break them.

The incident involved KelpDAO’s use of LayerZero’s cross-chain messaging system, a type of infrastructure widely used to move data and assets between blockchains.

Bridges are meant to let users move assets from one blockchain to another, like from Ethereum to a different network. But instead of acting as seamless connectors, they have repeatedly turned into weak points, draining billions of dollars over the past few years.

So why does this keep happening?

Crypto ecosystem leaders say the answer is not just bad code or careless mistakes. The problem is more fundamental; it is in how bridges are built in the first place.

The core problem: trusting the middleman

To understand the issue, it helps to look at what a bridge actually does.

If you move tokens from one blockchain to another, the second chain needs proof that your tokens existed and were locked on the first one. In an ideal world, it would verify that itself. In reality, that is too expensive and complex.

“Most bridges don’t fully verify what happened on another chain,” said Ben Fisch, CEO of Espresso Systems. “Instead, they rely on a smaller system to report it. That [second] system becomes the thing you trust.”

So instead of independently checking the truth, bridges outsource it, often to small validator groups or external networks like LayerZero or Axelar. That shortcut creates risk. In the Kelp DAO-related exploit, attackers targeted the data feeding into the bridge.

“Attackers compromised nodes and fed the system a false version of reality,” Fisch said. “The bridge worked as designed. It just believed the wrong information.”

Bridge hacks often look different on the surface. Some involve stolen keys, others faulty smart contracts. But experts say those are symptoms of a deeper issue. The real problem lies in how the systems are designed.

“Anything that can go wrong will go wrong, and bridge hacks are a perfect example,” said Sergej Kunz, co-founder of 1inch. “You see code vulnerabilities, centralization issues, social engineering, even economic attacks. Usually it’s a mix.”

How bridges work

For users, bridges look simple. You click a button and move assets from one blockchain to another. Behind the scenes, the process is more complicated.

First, your tokens are locked on the original blockchain. Then a separate system confirms that the tokens are locked. This system usually consists of a small group of operators or validators. Those operators then send a message to the second blockchain saying the tokens were locked so new ones can be issued. If that message is accepted, the second chain creates a new version of your tokens. These are wrapped tokens, like rsETH or WBTC.