Cross-Chain Vulnerabilities & Bridge Exploits in 2022

TL;DR: In 2022 five major cross-chain bridge attacks led to $1.317B in losses (57% of Web3 losses), including Ronin (suspected Lazarus Group, ~$624M), Wormhole (~$326M), Nomad (~$190M), Harmony (~$97M), and Qubit (~$80M). The report explains that cross-chain bridges combine multiple trust components (custodian, debt issuer, oracle) creating many attack vectors; it details the Nomad initialization bug that allowed message verification bypass and mass withdrawals involving at least 41 wallets, and recommends stronger testing and third-party audits to mitigate similar high-impact exploits.