Cross-chain bridge security and insurance matrix 2026 · full view of 14 protocols' trust model / hack history / coverage

TL;DR

• Comparison matrix of trust model · hack history · insurance · audit · recovery across 5 dimensions for 14 active cross-chain bridge / messaging protocols as of 2026-Q2
• Trust model 4 quadrants: native (CCTP V2 / IBC) · light-client / ZK (Wormhole ZK Verifier / Hyperlane ZK ISM) · validator-set / multisig (LayerZero v2 default · Wormhole Guardian · Axelar) · optimistic / fraud-proof (Across · Connext · Hyperlane optimistic ISM)
• Cumulative historical hacks ≥ $2.7B (2021-2025) · Ronin $625M · Wormhole $325M · BNB Bridge $570M · Poly $611M · Nomad $190M · Multichain $126M (2023 escape) · Orbit Chain $81M (2024) · after 2022.02 Wormhole was fully backfilled by Jump Crypto + fixed through 2024 ZK Verifier
• Insurance 3 major pools: Nexus Mutual ($120M capital · cover available for mainstream bridges) · InsurAce ($30M · deeper coverage of small and mid-sized bridges) · Sherlock (~$15M · audit + cover bundled · partial coverage for Hyperlane / LayerZero)
• In 2026 , only ~6 bridges are truly insurable (CCTP V2 · LayerZero v2 · Wormhole NTT · Across · Hyperlane · Axelar) · most bridges are too small in scale or too complex in trust model for insurers to underwrite
• Route: cross-chain-five-pole-comparison-matrix (general comparison) · cross-chain-four-poles-overview (architecture) · this matrix specializes in the security + insurance dimensions

Wiki route

This entry sits under systems index. Read it against Cross-chain 5 -pole comparison matrix · The 9 dimensions of CCTP V2 / CCIP / LayerZero v2 / Hyperlane / Wormhole for the general 9-axis bridge comparison, and use Cross-Chain 4 -Pole Architecture · LayerZero / CCIP / Wormhole / Hyperlane + CCTP V2 for the underlying architecture taxonomy. For protocol-specific deep dives see CCTP V2 overview · CCTP V2 technical spec · Hyperlane overview · Hyperlane ISM modular security · LayerZero v2 omnichain messaging · Chainlink CCIP institutional messaging. For selection logic across these trust models, use Cross-Chain Selection Decision Tree · Matching Protocols by Lead Dimension. Pair with chain abstraction overview and chain abstraction three solutions for the UX layer that sits above these bridges. For security forensics methodology used to reconstruct hack timelines, see security index and bytecode forensic three-tier verify.

Why this matrix matters

Cross-chain bridges are the single largest source of losses in the 2021-2024 crypto ecosystem — cumulative damage ≥ $2.7B · far above total CEX hacks. A critical gate before institutional money enters onchain finance (see the SWIFT / DTCC pilots in CCIP institutional) is whether a bridge is insurable, whether it can recover after an incident, and whether its trust model satisfies risk committee requirements.

However, the bridge security picture is scattered across protocol docs · Rekt leaderboard · L2Beat bridge risk · Nexus Mutual cover terms · individual audit firm reports — and no unified comparison view exists. This matrix lays out the 5 major dimensions of trust model · validator security budget · hack history · insurance coverage · audit firm · recovery process horizontally, so institutional / DeFi users can look beyond TVL and latency when selecting a bridge and ask: “if it is attacked today, how much of my $1M can be recovered, and through what process?”

The matrix compares the 2026-Q2 state and excludes already-sunset Multichain / Nomad / cBridge V1 and similar bridges. Synapse and Connext are close to sunset after large TVL declines, but are retained as reference.

Per-protocol sections

CCTP V2 (Circle)

Trust model: Native burn-mint · USDC is burned on the source chain · Circle’s offchain attester issues an attestation · it is re-minted on the destination chain. Single trust in Circle’s centralized attester · but backed by OFAC + §501 compliance. Fast Transfer V2 has 8-20 second finality (V1 is 10-20 minutes).

Validator security budget: Circle’s own reputation + compliance moat · not onchain economic stake. In theory, if the attester private key is compromised = arbitrary USDC minting is possible · but Circle can freeze contracts immediately (freeze capability was tested in practice in 2022 Tornado Cash sanctions).

Historical hacks: no major incident (from 2023-06 launch through 2026-Q2 ). In 2024 there was 1 temporary 6 -hour attestation service outage (no fund loss).

Insurance: Circle’s own SOC2 + reserve attestation (Deloitte quarterly audit). Nexus Mutual provides USDC depeg cover (not CCTP-specific). Lloyd’s of London indirectly covers some institutional customers’ USDC holdings through Coincover.

Audit coverage: OpenZeppelin · Halborn · ChainSecurity · passed 2025-Q4 SOC2 Type II.

Recovery process: Circle can freeze the receiver address · return funds to the source chain. Institutional customers are directly compensated through the Circle Mint OTC channel (backstop capability was demonstrated after the 2023 SVB crisis USDC depeg).

Hyperlane

Trust model: Permissionless · ISM (Interchain Security Module) is chosen by the app — multisig (default) · EigenLayer restaking · ZK · optimistic · POS. Each app sets its own security tradeoff (see Hyperlane ISM modular security).

Validator security budget: depends on ISM selection. Default multisig ~10-of-15 operators; EigenLayer-backed ISM reaches $1B+ ETH restake (2026-Q2); ZK ISM security is equivalent to the assumptions of the ZK proving system.

Historical hacks: no protocol-level incident from 2024.07 Eclipse mainnet launch through 2026-Q2 . However, individual apps have had small losses from ISM misconfiguration (2024.11 long-tail app attacked with 1-of-3 multisig setting · loss $1.2M · outside Hyperlane core responsibility).

Insurance: Sherlock provides an audit + cover bundle (~$5M cover for core Hyperlane contracts). Nexus Mutual has partial coverage (apps must apply themselves).

Audit coverage: Trail of Bits · Zellic · OpenZeppelin · CertiK. 2024-Q4 Cantina public contest.

Recovery process: Permissionless means Hyperlane Foundation has no forced recovery obligation. Apps define their own governance · can respond through ISM upgrade or offchain OTC negotiation. Foundation coordinates for major customers such as Eclipse / Celestia.

LayerZero v2

Trust model: DVN (Decentralized Verifier Network) M-of-N · apps define their own custom set. Default configuration = 3 社 of LayerZero Labs + Google Cloud + Polyhedra ZK. Lightweight ULN (Ultra Light Node) verifies at destination (see LayerZero v2 omnichain messaging).

Validator security budget: depends on the DVN set. LayerZero Labs itself is centrally operated · Google Cloud provides enterprise SLA · Polyhedra provides ZK proof + economic stake. Multi-DVN configuration cost increases with N.

Historical hacks: 2024.01 temporary DVN configuration bug · no fund loss (immediate rollback). 2023 one Stargate (upper-layer app on LayerZero) bug · no loss after fix. No major protocol-level incident since 2022 launch.

Insurance: Nexus Mutual ~$15M cover available. Multiple Sherlock contests. Medium InsurAce coverage. Stargate (token bridge on LayerZero) has its own insurance fund (LPs pay 0.06% fee into the insurance pool).

Audit coverage: Zellic · Trail of Bits · Spearbit · Code4rena multiple contests. Quantstamp + OpenZeppelin re-reviewed before 2024 ZRO token launch.

Recovery process: LayerZero Labs can propose, but does not force upgrades. App-level recovery is decided by the app team. Past Stargate incidents were resolved through insurance pool + LP haircut.

Wormhole

Trust model: 19-of-19 Guardian set multisig (institutional nodes such as Jump Crypto · Everstake · Forbole · Chorus One · Staked.us · Figment). Added ZK Verifier in 2024 as a second-layer fail-safe. NTT (Native Token Transfers) + CCTP integration borrows Circle attester for USDC cross-chain transfers (see cross-chain five-pole matrix).

Validator security budget: Guardian nodes are all institution-operated · but there is no explicit economic stake (slashing discussion began after 2024 W token launch). In theory, 13-of-19 collusion can sign arbitrary messages.

Historical hacks: 2022.02.02 Solana bridge theft of $325M (attacker used a signature verification bypass in the wormhole smart contract · minted 120,000 wETH without depositing ETH) · Jump Crypto fully backfilled 120,000 ETH within 24 hours · no user loss. This was one of the 1 largest single backstops in crypto history. After 2024 ZK Verifier went live, this attack type was cryptographically defended.

Insurance: no independent cover · but W token treasury + Wormhole Foundation holdings of ~$200M act as an implicit backstop. Jump Crypto’s 2022 backfill is treated as precedent (but there is no repeat promise after 2024 ). Nexus Mutual historically declined to underwrite Wormhole (after the 2022 hack) · partial cover availability recovered after 2024 ZK Verifier.

Audit coverage: Trail of Bits · OtterSec · Halborn · Coinspect. Multiple audits before NTT launch. 2024 ZK Verifier independently audited by Polyhedra.

Recovery process: 2022 Jump Crypto backfill was an ad hoc decision. The formal process is Foundation + Guardian vote to initiate a governance proposal. Institutional customers go through Wormhole Foundation OTC.

Chainlink CCIP

Trust model: Oracle DON (Decentralized Oracle Network · usually 16-of-31) + Risk Management Network (RMN · independent 2-of-N veto committee). Two-layer redundancy design · institutional grade (see Chainlink CCIP institutional messaging).

Validator security budget: Chainlink LINK token staking (v0.2 ~$2B staked, 2026-Q2) + RMN independent client (different codebase · prevents software bugs). RMN veto can freeze any suspicious message.

Historical hacks: no major incident (from 2023-07 mainnet operation through 2026-Q2 ). CCIP v1.5 had 1 risk window false positive (no fund loss · delay only).

Insurance: Chainlink Foundation holds LINK treasury as an implicit backstop. Nexus Mutual provides ~$8M cover. Institutional customers (SWIFT / DTCC / J.P. Morgan Kinexys) self-cover through their own risk teams + Lloyd’s syndicates.

Audit coverage: Trail of Bits · CertiK · Sigma Prime · NCC Group. Independent audit for every v upgrade.

Recovery process: RMN can veto immediately · DON can pause a lane. Chainlink Foundation coordinates institutional customer OTC settlement.

Across

Trust model: Optimistic · verified by UMA Optimistic Oracle. Relayer fronts funds at destination · then recovers source-chain collateral within the UMA 7200 second challenge window. Intent-based design (user submits intent · relayers bid).

Validator security budget: UMA OO bonding ~$50M total challenge pool · economic security of a single transaction equals bonded amount. Relayer brings its own collateral.

Historical hacks: no protocol-level hack (from 2022 launch through 2026-Q2 ). In 2024 , 1 relayer bug was identified by the community and withdrawn within 5 minutes.

Insurance: Sherlock provides ~$3M cover. Nexus Mutual partial coverage. Across DAO holds ACX treasury as an emergency fund.

Audit coverage: OpenZeppelin · Trail of Bits · Code4rena · Sherlock contests.

Recovery process: dispute within the challenge window · UMA committee arbitrates. After the challenge window, rollback is impossible · but relayer collateral can be slashed.

Stargate (LayerZero)

Trust model: Based on LayerZero v2 messaging + Stargate-specific liquidity pool model (unified liquidity · no single-chain lock). Inherits LayerZero v2 DVN trust assumptions.

Validator security budget: LayerZero DVN + Stargate LP collateral (single-pool TVL $50M-500M).

Historical hacks: in 2023.03 , 1 transfer bug caused ~$0 loss (fixed immediately). In 2024 , 1 Curve-style read-only reentrancy was discovered by a white hat and fixed (payout $500K). No large-scale loss.

Insurance: Stargate has its own insurance fund (LP fee 0.06% paid into the pool · balance ~$2M as of 2026-Q2). Nexus Mutual partial coverage.

Audit coverage: Zellic · Trail of Bits · Spearbit · Code4rena multiple times.

Recovery process: Insurance fund pays first · any shortfall is LP haircut. LayerZero Labs coordinates messaging-layer upgrades.

Synapse

Trust model: Validator set ~10-of-15 multisig (all operators undisclosed). Liquidity bridge model (AMM swap + cross-chain message). Optimistic mode added in 2024-Q4 , but adoption is low.

Validator security budget: validators have their own stake, but amount is undisclosed. TVL declined from 2023 peak $400M to ~ $30M in 2026-Q2 · attack surface shrank.

Historical hacks: no protocol-level hack · but in 2024 multiple LP pool drains from oracle manipulation caused cumulative losses of ~$3M. SYN token price is -95% from peak · actual economic security shrank materially.

Insurance: no independent cover available (insurers decline because TVL shrank + governance is opaque).

Audit coverage: Quantstamp · Halborn (2022). No new audit after 2025 .

Recovery process: Synapse DAO governance · but quorum is often not reached. Effectively close to sunset.

Connext

Trust model: Optimistic Rollup-style fraud proof + Sequencer model. Routers (similar to relayers) provide liquidity · 7-day challenge window. “xCall” is a chain-abstraction messaging API.

Validator security budget: Router collateral (total ~$10M, 2026-Q2 · sharply down from peak). Sequencer is centralized (Connext Inc.).

Historical hacks: no protocol-level hack · but in 2024-Q3 there was 1 router insolvency causing $400K LP loss (resolved by Connext Inc. self-compensation).

Insurance: initial Sherlock cover expired and was not renewed. Nexus Mutual declined to underwrite (opaque governance).

Audit coverage: Spearbit · Code4rena (2023).

Recovery process: dispute within the challenge window · but rarely triggered in practice. Connext Inc. leads ad hoc recovery.

Squid

Trust model: swap router on Axelar + cross-chain UX layer. Inherits the underlying Axelar validator set (75 node PoS). Squid itself does not handle messaging · it is an aggregator.

Validator security budget: borrows Axelar AXL staking ~$300M (2026-Q2).

Historical hacks: no protocol-level hack. 1 frontend XSS attack in 2023 affected users for ~$50K (fixed).

Insurance: no independent cover · borrows Axelar-layer risk. Squid holds reserves as emergency.

Audit coverage: Halborn · Spearbit.

Recovery process: depends on Axelar network governance · Squid team coordinates frontend-layer incidents.

Axelar

Trust model: 75-validator PoS network (CosmosSDK + Tendermint base) · cross-chain messages are signed by 2/3 validator quorum. General Message Passing (GMP) + Interchain Token (ITS) model.

Validator security budget: AXL token staking ~$300M (2026-Q2). Validator set is public · includes institutional nodes such as Binance · Coinbase Custody · Imperator · DSRV.

Historical hacks: no protocol-level hack (from 2022 launch through 2026-Q2 ). In 2024 , 1 ITS configuration bug was discovered by a white hat · payout $200K · no user loss.

Insurance: Nexus Mutual ~$5M cover. Medium InsurAce coverage. Axelar Foundation treasury as backstop.

Audit coverage: Trail of Bits · ChainSecurity · Code4rena · Cantina.

Recovery process: Axelar governance (AXL token-based) · 2/3 validator consensus can freeze or roll back a lane. Institutional customers go through Foundation OTC.

deBridge

Trust model: 12 validator delegated PoS · Chainlink CCIP integration as fallback. “DLN” (deBridge Liquidity Network) intent-based settlement layer.

Validator security budget: DBR token staking ~$80M (2026-Q2 estimate).

Historical hacks: no protocol-level hack. In 2022 , 1 Lazarus phishing attack frontend (deBridge team warned) · no actual loss.

Insurance: no mainstream insurer cover available. deBridge DAO treasury as emergency.

Audit coverage: Zokyo · Halborn · Ackee Blockchain.

Recovery process: Validator quorum can pause messages. DAO vote decides recovery.

Symbiosis

Trust model: Relayer network + threshold signature scheme (TSS) · 15-of-21 multisig. Positioned as cross-chain swap aggregator.

Validator security budget: SIS token staking ~$15M (2026-Q2). TVL ~$40M.

Historical hacks: no protocol-level hack. In 2023 , 1 frontend bug affected < $10K.

Insurance: no cover available.

Audit coverage: Hacken · CertiK · Beosin.

Recovery process: Foundation coordination.

Allbridge

Trust model: Allbridge Classic (liquidity bridge · 2/3 multisig) + Allbridge Core (stablecoin AMM · independent LP on each chain). Trust assumptions differ across 2 product lines.

Validator security budget: small multisig · total TVL ~$20M (2026-Q2).

Historical hacks: 2023.04.01 Allbridge Classic lost $570K in a flash-loan attack (BUSD/USDT pool drain on BSC). Hacker later returned 60% (20% bounty). Classic has been deprecated since then. Core product line has no incident.

Insurance: no cover available.

Audit coverage: Hacken · SmartState (2022). Core audited by Halborn.

Recovery process: Foundation coordination · Classic already frozen.

Big comparison matrix table

Public security-boundary comparison across 14 protocols. Do not assert insurance amounts, audited scope, absence of incidents or compensation availability without checking contracts and reports for the relevant date:

Sources: ^[https://developers.circle.com/stablecoins/docs/cctp-getting-started] ^[https://docs.hyperlane.xyz/] ^[https://docs.layerzero.network/v2] ^[https://docs.wormhole.com/] ^[https://docs.chain.link/ccip] ^[https://docs.across.to/] ^[https://stargateprotocol.gitbook.io/stargate/] ^[https://docs.synapseprotocol.com/] ^[https://docs.connext.network/] ^[https://docs.squidrouter.com/] ^[https://docs.axelar.dev/] ^[https://docs.debridge.finance/] ^[https://docs.symbiosis.finance/] ^[https://docs.allbridge.io/]

How to read the matrix:

• Read horizontally for the 7 -dimension profile of 1 protocols · read vertically for 14 protocol differences within the same dimension
• Insurance availability is the strictest selection filter — among 14 protocols, only ~6 have real cover from mainstream insurers · the rest only have implicit backstops from their own treasury
• Hack-free track record ≠ safety — Synapse / Connext have no protocol-level hack, but economic security has already shrunk to levels that are hard to underwrite
• The combination of trust model + validator security budget determines true attack cost · Wormhole 19 Guardian has no explicit stake but has an institutional reputation moat · LayerZero default DVN likewise relies on enterprise SLA rather than economic stake

Boundary cases / future trajectory

The 2 paradigms of recovery process:

• Centralized backstop (CCTP V2 Circle / Wormhole Jump-style compensation / Connext Inc. ad hoc) — recovery is fast, but depends on a single entity’s reputation and capital
• Decentralized governance recovery (Axelar PoS validator consensus / Hyperlane DAO / Across UMA dispute) — recovery is slower but censorship-resistant · truly decentralized

Institutional customers (SWIFT / DTCC / J.P. Morgan Kinexys · see CCIP institutional) prefer centralized backstops, while DeFi-native users prefer decentralized governance · there is no one-size-fits-all.

Insurance pool capacity bottleneck: Nexus Mutual total capital is ~$120M · even allocating all of it to bridge cover cannot underwrite $50B+ cross-chain TVL. This means insurance is forever only a “tail risk top-up”; the main backstop is protocol treasury + foundation. Sherlock’s “audit + cover bundle” model tries to change incentives, but capital became tight after multiple claims in 2024-2025 .

2027-2028 trends:

• Adoption of ZK light clients evolves the trust model from “validator set” to “math + DA” — Hyperlane ZK ISM · Wormhole ZK Verifier · LayerZero Polyhedra DVN are early movers (see multi-proof aggregation fault prover)
• Restaking-backed bridge security (EigenLayer / Symbiotic AVS model · see EigenLayer overview) lets validator sets borrow ETH stake · but rehypothecation systemic risk remains unresolved
• Native L2-to-L2 messaging (Optimism Superchain · Polygon AggLayer · Arbitrum Orbit cross-chain) removes the need for third-party trust for bridges inside the same ecosystem · directly borrows the settlement layer · erodes demand for general-purpose bridges over the long term
• Post-quantum bridge migration (see post-quantum blockchain day 1 integration) requires signature-algorithm upgrades for all bridges in 2030+ · most bridges have no public roadmap

Formal verification: Hyperlane / LayerZero / Wormhole have all begun introducing formal specs (see formal spec implementation codesign), but actual coverage is < 30% of the codebase. CCIP is one of the few with institutional-grade formal verification (NCC Group + Galois joint audit).

Truly insurable vs nominally insurable: Nexus Mutual / InsurAce / Sherlock cover terms separate “smart contract failure” and “validator collusion” into different covers · most users buy only the former · but 60%+ of historical hacks are the latter. This means nominal cover ≠ real payout, and users need to read policies carefully.

Related

• Wiki Index
• systems index
• cross-chain five-pole comparison matrix
• cross-chain four poles overview
• CCIP institutional default
• cross-chain selection decision tree
• CCTP V2 overview
• CCTP V2 technical spec
• Hyperlane overview
• Hyperlane ISM modular security
• Hyperlane vs LayerZero/CCIP
• LayerZero v2 omnichain messaging
• Chainlink CCIP institutional messaging
• chain abstraction pattern overview
• chain abstraction three solutions
• security index
• bytecode forensic three-tier verify

Sources

• Circle CCTP V2 docs · https://developers.circle.com/stablecoins/docs/cctp-getting-started
• Hyperlane docs · https://docs.hyperlane.xyz/
• LayerZero v2 docs · https://docs.layerzero.network/v2
• Wormhole docs · https://docs.wormhole.com/
• Chainlink CCIP docs · https://docs.chain.link/ccip
• Across docs · https://docs.across.to/
• Stargate docs · https://stargateprotocol.gitbook.io/stargate/
• Synapse docs · https://docs.synapseprotocol.com/
• Connext docs · https://docs.connext.network/
• Squid docs · https://docs.squidrouter.com/
• Axelar docs · https://docs.axelar.dev/
• deBridge docs · https://docs.debridge.finance/
• Symbiosis docs · https://docs.symbiosis.finance/
• Allbridge docs · https://docs.allbridge.io/
• DefiLlama bridges analytics · https://defillama.com/bridges
• Rekt leaderboard · https://rekt.news/leaderboard/
• DeFiYield Rekt database · https://defiyield.app/rekt-database
• Nexus Mutual cover terms · https://nexusmutual.io/
• InsurAce coverage list · https://insurace.io/
• Sherlock audit + cover model · https://www.sherlock.xyz/
• L2Beat bridges risk summary · https://l2beat.com/bridges/summary