Wrapped Tokens and Bridges

Blockchains cannot natively talk to each other, so moving an asset from one chain to another means locking it in one place and issuing a stand-in on the other — a wrapped token — via a system called a bridge. Bridges work, and millions of users rely on them, but they concentrate enormous value behind relatively thin security, which is why several of the largest hacks in crypto history have been bridge hacks. Understanding how wrapping works, and what you actually hold afterward, is the difference between using bridges deliberately and trusting them blindly.

Why Assets Can't Just Move Between Chains

A bitcoin exists only as an entry in Bitcoin's ledger. An ether exists only in Ethereum's. There is no cable between them: Ethereum's validators have no way to verify, natively and trustlessly, what happened on Bitcoin, and vice versa. Each chain is a closed accounting system.

So when you "move" BTC to Ethereum, no bitcoin actually travels anywhere. Instead, some mechanism takes custody of your BTC on Bitcoin and mints a claim token on Ethereum — for example WBTC, an ERC-20 token designed to track bitcoin's value one-to-one. The original asset stays put; what moves is a promise.

This is the single most important mental model: a wrapped token is an IOU, and it is only as good as whoever or whatever holds the underlying asset. WBTC is worth roughly one BTC because the custodian actually holds one BTC per WBTC and will redeem it. If the backing ever failed — through hack, fraud, or seizure — the wrapped token would trade at whatever the market thinks the residual claim is worth, which could be far below the "pegged" price.

How Wrapping Works: Lock-and-Mint, Burn-and-Release

Most bridges follow the same basic loop:

Lock: You send 1 BTC (or 1,000 USDC, or whatever) to an address or smart contract controlled by the bridge on the source chain.
Mint: The bridge observes the deposit and mints an equivalent wrapped token on the destination chain to your address there.
Burn: When you want to go back, you send the wrapped token to the bridge contract on the destination chain, which destroys it.
Release: The bridge unlocks the original asset on the source chain and returns it to you.

The supply of wrapped tokens on the destination chain should always equal the assets locked on the source chain. Every bridge exploit is, at bottom, a way of breaking that equation — minting wrapped tokens without a real deposit, or draining the locked collateral while the wrapped tokens still circulate.

Who watches the lock?

The differences between bridges come down to who verifies step 2:

Custodial bridges rely on a company or consortium. WBTC works this way: a custodian holds the BTC, and merchants handle mint/burn. You are trusting a business, much like trusting an exchange.
Multisig / validator bridges use a committee of signers, often 5-of-9 or similar. If enough keys are compromised, the bridge can be drained. The Ronin bridge hack in 2022, one of the largest ever at roughly $600 million, happened because attackers compromised a majority of validator keys.
Light-client / native verification bridges have the destination chain cryptographically verify the source chain's state. This is the most trust-minimized design but is expensive and complex, so it's less common.
Liquidity-network bridges don't mint anything; they match you with liquidity that already exists on the destination chain and settle between pools. You receive the native asset, not a wrapped one, which removes the long-term IOU risk but depends on pool depth.

A related note: Layer 2 rollups have "native" bridges to Ethereum whose security is largely inherited from Ethereum itself. Those are a meaningfully different — and generally stronger — trust profile than third-party bridges between unrelated chains.

Why Bridges Are Hack Magnets

Bridges combine three properties attackers love.

They are honeypots. A bridge's locked collateral can reach hundreds of millions or billions of dollars sitting behind a single contract or key set. The Wormhole exploit (about $320 million) and the Ronin hack made bridges the site of some of crypto's costliest incidents.

They are complex. A bridge spans two or more chains, off-chain relayers, and message-passing logic. Every extra component is attack surface, and a bug on either side can compromise funds.

Their failure is silent until it isn't. If a bridge is exploited, the wrapped tokens you hold on the destination chain don't disappear — they just quietly stop being fully backed. You can be holding a depegging IOU without having done anything.

There's also a subtler risk: liquidity fragmentation. The same underlying asset can have several wrapped versions from different bridges on one chain (for example, multiple flavors of bridged USDC before native issuance arrived on many networks). They are not interchangeable, they have different backing, and the less popular versions can suffer wide spreads or become stranded if their bridge shuts down.

Safer Bridging Habits

You often can't avoid bridges entirely, but you can shrink the risk.

Prefer native issuance over wrapping. If the asset exists natively on your destination chain — USDC issued directly by Circle on that network, for instance — hold that rather than a bridged version. Check the token contract, not just the ticker.
Prefer official or canonical bridges. For moving to an L2, the rollup's native bridge (or a well-established fast-bridge that settles through it) generally carries less exotic trust than a third-party bridge between unrelated chains.
Minimize time-in-bridge exposure. Bridge what you need, when you need it. Don't park long-term holdings as wrapped IOUs on a foreign chain if you have the option to hold the native asset on its home chain.
Size the transfer to the risk. Moving $200 through a newer bridge to try an app is a different decision than moving $50,000 of savings. For large amounts, consider splitting transfers, or routing through a centralized exchange that supports withdrawal on both chains — that swaps bridge risk for exchange risk, which for a short window and a reputable venue may be the better trade.
Send a test transaction first. Fees for a small test are cheap insurance against wrong networks, wrong token versions, or unsupported destination addresses.
Verify the site and contract. Bridge front-ends are prime phishing targets. Use bookmarks, double-check URLs, and review exactly what token you're receiving before you sign.
Know your exit. Before bridging in, understand how you'd bridge out, what it costs, and how long it takes. Optimistic rollup native withdrawals, for example, take about a week unless you pay a fast-bridge to front you liquidity.

Key Takeaways

Assets never actually move between chains; bridges lock the original and mint a wrapped IOU on the destination chain, and that IOU is only as good as its backing.
Bridge security varies enormously — custodial, multisig, and light-client designs carry very different trust assumptions, and multisig key compromise has caused several of crypto's biggest hacks.
Wrapped tokens can silently lose their backing in an exploit; the same asset can also exist in multiple non-interchangeable bridged versions on one chain.
Prefer natively issued assets and canonical bridges, keep bridged balances small and short-lived, and always send a test transaction for meaningful amounts.
Match the bridge to the stakes: small experimental transfers and large savings movements deserve different routes and different levels of caution.