Bridge Exploit attacks in 2022

A flawed Merkle proof verification in BSC's native bridge let the attacker forge withdrawals for 2M BNB before validators paused the chain.

A routine upgrade marked the zero hash as a valid root, turning every Nomad message into a withdrawal anyone could copy-paste.

Lazarus compromised two of five operator multi-sig keys on Harmony's cross-chain bridge and drained $100M; the 2-of-5 quorum was below its risk profile.

Meter Passport bridge lost $4.4M when its deposit handler trusted a wrapped-token transfer amount that could be set without backing, minting bridged BNB/ETH.

A signature-verification bypass on Wormhole's Solana side let the attacker mint 120,000 wETH out of thin air — backed by no Ethereum collateral.

An attacker tricked Qubit's BSC bridge into minting 77,162 qXETH ($185M nominal) without depositing any ETH, borrowing 206,809 BNB ($80M).