The chains are secure, the bridge in between usually isn't
It's a consistent pattern across the industry that the largest exploits in crypto have targeted bridges rather than the underlying blockchains they connect. This is not a coincidence, it follows directly from everything covered so far in this course. A well-established blockchain like Ethereum or Bitcoin has years of adversarial testing, a large, decentralized validator set, and battle-hardened consensus code. A bridge contract, by contrast, is a comparatively new, custom piece of software that concentrates enormous value, because it holds the locked collateral backing every wrapped token in circulation, or the pooled liquidity enabling every swap, in one place.
The vulnerability class that keeps showing up is not a flaw in the source or destination chain's core protocol, it's a flaw in the bridge's own validation or signing layer, the exact intermediary component that had to be built precisely because two independent chains can't verify each other natively. That can mean a bug in the smart contract logic that checks proofs before releasing funds, a compromise of enough private keys in a federated validator set to forge a false attestation, or a flaw in how signatures are verified that lets an attacker forge authorization without ever controlling a legitimate validator. In every case, the underlying chains themselves worked exactly as designed. The exploit happened in the custom-built glue holding two secure systems together.