Attack Patterns in Cross-chain Bridges: A Trust-based Empirical Analysis
The rapid growth of multiple blockchain ecosystems has made cross-chain bridges essential for transferring assets and information across independent blockchains. Their multi-component architectures, cross-chain trust assumptions, and concentration of valuable assets expose them to diverse security threats. This paper presents an empirical study of cross-chain bridge attacks based on 48 evidence-supported real-world incidents from January 2022 to August 2026. We propose a behaviour-based attack pattern architecture comprising six trust-violation attack patterns, each defined by the primary trust assumption violated by the attacker: Proof Forgery,Logic Exploitation, Event Injection, Economic-State Manipulation, Credential Seizure, and Infrastructure Hijacking. The architecture further maps these patterns to five functional domains of cross-chain bridges: Deposit, Relay, Verification, Execution, and Governance and Operations, separating how a trust assumption is violated from where the compromised trust boundary lies. The 48 incidents correspond to $2.676 billion in gross bridge-specific losses, with the ten largest incidents accounting for 92.4% of total losses. Measured on the primary loss basis, Proof Forgery and Credential Seizure make up 86.2% of all losses, and the Verification and Governance and Operations domains hold 93.9%. A handful of very large incidents drives this concentration, yet it still holds when we switch to other loss bases or reclassify the boundary cases. By tying what attackers do to the bridge functions and security assumptions they target, the architecture gives threat modelling for cross-chain bridges an empirical footing.