The bridge that never bridged

February 2025. A holder in Austin wants to move $48,000 in USDC from Arbitrum to Solana. He searches "USDC bridge arbitrum solana" and clicks the top sponsored result — hypercross-bridge[.]io. The interface looks like a polished bridge aggregator. He connects his MetaMask, approves USDC spending, and submits the bridge. The site shows "Bridging in progress... typical time 5–15 minutes." The USDC leaves his Arbitrum wallet. Nothing arrives on Solana.

How fake bridges convert real assets to losses

The fake bridge collects the user's assets on the source chain (real transactions, real approvals) and then either (1) keeps the funds and waits out the user's complaints, or (2) routes a small portion to the user's destination wallet to simulate partial success before abandoning. There is no actual bridge — just a pair of wallets the operator controls.

The five rules for cross-chain bridges

  • Use only audited, multi-year-old bridges. For USDC: Circle's CCTP (Cross-Chain Transfer Protocol). For general assets: Wormhole, Stargate, Across, deBridge — all have years of operation and billions in cumulative volume. Age and volume lower the risk without removing it — Wormhole itself was exploited in 2022 — and anything younger or less established is taking risks the user cannot evaluate.
  • Find bridges through official pages, not search ads. Start from the chain's own portal or documentation, or from the token issuer's page (Circle's for CCTP), and bookmark the bridge you end up using. Search results are gamed; official documentation is not a perfect list, but it is a far safer starting point.
  • Bridge a test amount first. A small transfer shows whether the route works, and if anything is off you have lost $50. It does not prove the site is honest: fake bridges sometimes deliver small amounts to build trust, as described above. The test is on top of the URL check, never instead of it.
  • The URL is verified character-by-character. stargate.finance not stargate-bridge[.]io. across.to not across-bridge[.]com. Sponsored results for bridge names are a favorite spot for phishing ads.
  • Bridge transactions show on both chains' explorers. A real bridge produces a lock or burn transaction on the source chain and a mint or release transaction on the destination chain, both visible on block explorers within the protocol's stated timeframe. If you cannot find the destination-side tx, the bridge did not happen.

If the source-chain tx confirmed but destination never arrives

Wait out the maximum window the protocol states in its own docs; it varies by bridge and route. Only use support links from the real protocol's documentation, and ignore anyone who DMs you first. No destination-side transaction after the stated window means the bridge did not happen, whether or not the site is still up. File IC3, document every transaction hash, and report the URL to anti-phishing databases.

The hard rule

Bridging is one of the highest-risk actions in DeFi because the user has to trust both the source-chain contract and the destination-chain release mechanism. Use only protocols where the audit history, the team, and the years of operation collectively make the risk understandable.