A bridge moves tokens from one blockchain to another. You need one when your assets are on Ethereum but you want to use a protocol on Arbitrum, or when you're on Solana and need funds on Base. Without bridges, every chain is an isolated island. Below are 6 apps covering every bridging scenario you'll run into in DeFi 👇
Free bridges for USDC and USDT:
⏺USDC
⏺USDT
Both take zero fee from the transfer amount. CCTP runs on Circle's native protocol: it burns USDC on the source chain and mints fresh USDC on the destination. No wrapped tokens, no slippage. USDT0 does the same for Tether via LayerZero's OFT standard, so what arrives is native USDT, not a bridged copy. You only pay gas.
Aggregators:
⏺Jumper
⏺Bungee
These scan available bridge and swap routes and return the best option. Good default when you're moving any token between major chains and don't want to search the best route manually.
Gas bridges:
⏺Gas.zip
⏺Smolrefuel
Built for one specific problem: you're on a chain with no native token to pay fees. Both let you send a few dollars of gas to any supported chain.
How Crypto Bridges Work and Why They Keep Getting Exploited 🤔
Bridges are the most exploited infrastructure in DeFi. Over $2 billion has been stolen through bridge hacks, more than any other category in crypto.
A bridge moves tokens between two blockchains that can't verify each other's state. Ethereum has no way to confirm what happens on Solana, so the bridge makes that verification happen through its own system.
🤔 The most common design is lock-and-mint. You deposit ETH into a contract on Ethereum and the bridge mints wrapped ETH on the another blockchain. To move back, you burn the wrapped token and the original gets unlocked.
Two other designs exist:
🔵Liquidity network bridges hold pools on both chains and you withdraw from the destination pool instead of receiving a minted token.
🟢Message-passing bridges relay arbitrary instructions between chains rather than moving assets directly, with the attack surface in the code that decides whether a message is valid.
The exploits always track the design.
1️⃣Ronin exploit was lock-and-mint: validators controlled the locked pool, so compromising 5/9 keys was enough to authorize $625 million in fraudulent withdrawals.
2️⃣Wormhole used a message-passing layer for verification, and a forged guardian signature let the attacker mint 120,000 ETH on Solana without locking anything on Ethereum, costing $320 million.
3️⃣Liquidity network bridges haven't been hit at the same scale: THORChain was exploited three times in one month in 2021, but lost only $13 million across the attacks. Each hack could only drain specific pools at a time rather than the full protocol.