Curriculum·J301 Chains, Layer 2s, and Bridges·about 31 min
Bridge architectures
By the end of this lesson you can
- →Classify any bridge by how the destination chain learns what happened on the source
- →Explain why a wrapped asset is a claim on a lock contract rather than the asset
- →Compute the backing ratio of a wrapped asset after an unbacked mint
- →Identify who bears the loss when a bridge fails, which is usually not the bridge's users
Junior · enrolled learners
This lesson opens with Wormhole, 2 February 2022.
- What happened
- The Wormhole bridge connected Ethereum and Solana. Transfers were authorized by signatures from a set of guardian nodes. An attacker used a deprecated and insecure function to bypass signature verification, spoofing a guardian account and producing what the bridge accepted as a valid authorization. That let them mint 120,000 wrapped ETH on Solana without depositing anything, worth roughly $326M. On 3 February, Jump Crypto deposited 120,000 real ETH into the bridge to restore the one-to-one backing, absorbing the loss so that holders were made whole. In February 2023, Jump Crypto and Oasis conducted a counter-exploit against the attacker and recovered around $225M.
- The decision point
- The people who lost backing were not the bridge's users. A wrapped asset is a claim on the lock contract, so the moment 120,000 unbacked units existed, every holder of wrapped ETH on Solana held a claim on a pool that was short by that amount, including people who had bought it on a decentralized exchange, posted it as collateral, or supplied it to a pool, and who had never touched the bridge. They inherited the exposure by holding the token.
- Recorded loss
- $326,000,000
What you will be able to answer
- →What is the classifying question for any bridge?
- →What is a wrapped asset?
- →Who bears the loss when a lock-and-mint bridge is drained?
- →Which architecture avoids the wrapped asset entirely?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.halborn.com/blog/post/explained-the-wormhole-hack-february-2022
- https://www.coindesk.com/tech/2022/02/02/blockchain-bridge-wormhole-suffers-possible-exploit-worth-over-250m
- https://www.merklescience.com/blog/hack-track-analysis-of-wormhole-token-bridge-exploit
- https://l2beat.com/bridges/summary
Confidence high·Volatility medium·Reviewed 2026-08-06·Owner unassigned
Contested
Naming Wormhole is not a claim about its current security, which was rebuilt after 2022 and is materially different. The incident is used because the mechanism is the clearest available illustration of what a wrapped asset is a claim on.
That a well-capitalized parent absorbed a $326M loss is not a property of bridges and should not be read as one. J301-05 covers what determines recovery, and the answer is a decision by somebody else in most cases.