More than half of crypto losses in May came from bridge failures

Post original

The honeypot economics angle doesn't get enough attention. Bridges need deep liquidity to be useful, so they lock up millions in TVL — and that TVL becomes a target that grows faster than the security posture around it. It's a losing arms race: more TVL attracts better-funded attackers, and a single successful exploit pays for years of dedicated R&D against your specific architecture. The revenue bridges generate from fees is a tiny fraction of what's at risk. This is fundamentally different from L1 consensus security. Ethereum's PoS security budget scales with the value it protects. Bridge security doesn't — you can spend $10M on audits and still lose $50M to a novel TSS implementation edge case that no auditor caught. The approaches that sidestep this entirely are the ones where there's no custodial liquidity pool to drain in the first place. If funds never sit in a third-party contract, the attack surface changes from "make the vault harder to crack" to "there is no vault." Would be interesting to see if validator-set bridges account for a disproportionate share vs. light-client or optimistic designs in the May data.