Cross-chain bridge security is back under pressure after PeckShield said hackers have drained a combined $328.6 million from major bridge-related exploits so far this year.
In a new PeckShieldAlert post, the blockchain security firm said the crypto sector had seen eight major bridge-related incidents by mid-May 2026. The table attached to the alert groups the incidents under one category: cross-chain infrastructure that allowed attackers to move, mint, drain, or extract value across connected networks.
The figure should be treated as a monitor estimate rather than a final postmortem total. Bridge incidents often change after teams reconcile contracts, wrapped assets, liquidity pools, affected chains, recovery efforts, frozen balances, bounty negotiations, and returned funds. Still, the $328.6 million aggregate shows that bridges remain one of crypto’s highest-risk infrastructure layers.
The latest alert arrives just after the Verus-Ethereum Bridge contract was hit by a suspicious transaction that moved 1,625.36 ETH, 103.56 tBTC and 147,658 USDC from the bridge contract to one receiving wallet. That incident alone placed another $11.5 million loss estimate into the 2026 bridge-security picture.
Why Bridges Keep Breaking
Bridges are difficult to secure because they sit between chains rather than inside one simple execution environment. A bridge can depend on validators, relayers, multisigs, liquidity pools, wrapped assets, oracle messages, proof verification, admin keys, contract upgrades, and offchain coordination. A weakness in any one of those layers can create a path for attackers.
That is why bridge incidents are often different from normal token exploits. Some attacks drain locked reserves. Others mint unbacked wrapped assets. Some exploit message validation, while others rely on compromised keys or bad contract permissions. Chainlink’s bridge-security research lists several recurring failure points in cross-chain bridge architecture, including validator compromise, smart-contract bugs, oracle or relayer failures, and liquidity concentration.
Recent incidents have shown how varied those paths can be. The Adshares bridge exploit involved a fake wADS mint, while the THORChain exploit alert involved suspected multi-chain movement across Bitcoin, Ethereum, BSC and Base. Saga also paused SagaEVM earlier this year while investigating a USDC bridge-related incident.
Recovery Depends On Speed And Asset Type
The recovery path after a bridge exploit depends heavily on how quickly the stolen assets move and what assets are involved. Centralized stablecoins can sometimes be frozen if issuers receive enough information quickly. ETH, BTC-linked assets, and decentralized tokens are harder to stop once attackers swap, bridge, split, or deposit them through intermediaries.
Security teams now watch for several immediate signals after bridge incidents: contract pauses, emergency admin actions, affected asset lists, exploit transaction hashes, attacker wallets, exchange deposits, cross-chain routing, and onchain messages offering bounties. Those details matter because the first few hours can decide whether part of the loss is frozen, returned, or permanently mixed into harder-to-trace routes.
PeckShield’s $328.6 million estimate puts the 2026 bridge problem back in hard numbers. The next useful updates will be incident-by-incident postmortems, confirmed root causes, recovered balances, bridge restarts, user compensation plans, and whether protocols change verification, pause, admin-key, or liquidity-limit designs before the next cross-chain exploit hits.
