How to Check a Bitcoin Bridge Before You Trust It

Bridge hacks have cost billions. Use this checklist to vet a Bitcoin bridge's custody, audits, refund path and track record before you send BTC.

TL;DR

To check a Bitcoin bridge, find out who can move your bitcoin while it is in transit, and how many keys or people would have to fail for you to lose it. Then confirm what you actually receive, whether you can get a refund on your own if a swap stalls, who audited the code, who can change it, and how the team handled past incidents.

These checks matter because bridges are where attackers go. Chainalysis estimated in August 2022 that $2 billion had been stolen from cross-chain bridges that year, 69% of all crypto stolen in that period. On April 18, 2026, one forged message drained $292 million from Kelp DAO's bridge.

Below: how the big bridge hacks happened, the five types of bridge, an eight-point checklist, the red flags that should stop you, and the checklist run on a real bridge.

How the biggest bridge hacks happened

Most large bridge losses came from a few keys or one verifier guarding a large pool of funds, not from exotic cryptography. A bridge that pools deposits creates one target. Whoever controls the signatures over that pool controls the money.

Four of these seven were key or verifier compromises, and a fifth was a custody failure. No code audit would have caught them. That is why the checklist starts with custody and keys, not audits.

The five types of Bitcoin bridges

Every bridge design answers one question differently: who holds your Bitcoin while it moves? Know the type before you read anything else, because it decides which risks you carry.

The first three pool user deposits behind keys, which is where most of the losses above came from. Atomic swaps never pool user funds: each swap is its own locked contract that either completes or refunds.

The 8-point Bitcoin bridge checklist

Run these checks in order. A bridge that fails any of the first four shouldn't get your bitcoin, however good the rest looks.

1. Who holds the bitcoin while it moves?

Open the bridge's security or "how it works" page and name the party: a company, a set of signers, a node network, or no one. If the docs don't say clearly, treat that as your answer.

2. How many keys would an attacker need?

For a multisig or MPC bridge, find the threshold (2 of 5? 5 of 9?) and who runs each signer. Independent operators in separate organisations are far stronger than several keys held by one team. A single verifier is a single point of failure, as Kelp DAO found. L2BEAT's bridge pages summarise these trust assumptions for many bridges.

3. What do you actually receive?

Native BTC sits on Bitcoin and needs no one to honour it. A wrapped token is a claim that is only as good as its issuer, and you may not be able to redeem it yourself.

4. Can you get a refund without the team?

Ask what happens if a swap stalls halfway. The best answer is a timelock that returns your funds on-chain after a set period, with no support ticket needed.

5. Who audited it, and when?

Look for several independent audits, published in full, that cover the contracts live today. Check that serious findings are marked fixed. A three-year-old audit of old code tells you little.

6. Is there a live bug bounty?

A public bounty with a meaningful top reward pays researchers to report flaws instead of exploiting them. Check that it is still active, not lapsed.

7. Who can change or pause the contracts?

Find out whether the contracts are upgradeable, who holds the admin keys, and whether upgrades wait behind a timelock. Nomad lost $190 million after a routine upgrade.

8. What happened last time something went wrong?

Search the bridge's name in DeFiLlama's hacks database and on Rekt. Read the post-mortem: what failed, whether users lost money, and what changed afterwards. A clean history is best; a transparent one is next best.

Copy this checklist

• I can name who holds the funds in transit
• The key threshold and signers are public and independent
• I receive native BTC, or I accept the issuer's risk
• I can refund on-chain if the swap stalls
• Recent public audits cover the live contracts
• A bug bounty is active
• Upgrades are time-locked, or contracts can't be upgraded
• Past incidents have public post-mortems

Red flags that should stop you

Any one of these is reason enough to walk away or send only a small test amount.

• The docs can't tell you who holds the keys.
• A small multisig, such as 2 of 5, guards a large pool of funds.
• Every signer belongs to one company or one person.
• There is no on-chain refund; a stalled swap means a support ticket.
• Audits are private, old, or cover different contracts from the ones you'll use.
• Admins can upgrade the contracts instantly.
• A past hack has no public post-mortem.
• You reached the site through a DM, an ad, or a "support agent". Type the URL yourself and match the contract address against the official docs.

Worked example: the checklist run on Garden

Here is the same checklist run on Garden, an atomic swap bridge, including the two incidents in its record.

Frequently asked questions

What is the safest type of Bitcoin bridge?

No bridge is risk-free. Designs that never pool user funds and let you refund on-chain remove the risk behind most large hacks. Atomic swaps work this way; custodial and small-multisig bridges carry the most counterparty risk.

Is an audited bridge safe?

Not on its own. Audits check code at a point in time. Ronin, Harmony and Orbit lost funds through compromised keys, which a code audit doesn't cover.

What is the difference between native BTC and wrapped BTC?

Native BTC lives on the Bitcoin blockchain, controlled by your own keys. Wrapped BTC is a token on another chain that represents a claim on bitcoin someone else holds.

How do I check a bridge's track record?

Search its name on DeFiLlama's hacks database and on Rekt, then read the team's post-mortems. Look at what failed and whether users were made whole.

Has Garden been hacked?

Garden says its protocol contracts have not been exploited. Two independent solvers were breached, in October 2025 (about $11 million) and July 2026 (about $450,000), and Garden says no user funds were lost.

Should I test with a small amount first?

Yes. Send a small amount, confirm it arrives at the address you expect, then send the rest.