Cross-chain bridges

Use the canonical bridge and wait. For deposits INTO an L2 there is not even a trade-off to think about — the canonical bridge takes minutes and has no challenge window, so there is no speed argument for using anything else, ever. For withdrawals, the seven-day window on Arbitrum, Optimism and Base is not a delay that clever bridges engineered away: it is the exact period during which Ethereum itself can be used to prove that a withdrawal is fraudulent. A fast bridge is fast for one reason — it substituted somebody’s signature for that proof.

No, and this is the single most under-reported risk in mainstream crypto. Per Polygon’s own documentation, the PoS contracts on Ethereum are controlled by a 5-of-9 multisig — the same threshold that lost Ronin $625 million. Most people think of "the Polygon bridge" the way they think of the Arbitrum bridge, as something Ethereum itself secures. It is not. It is nine keys, five of which are enough, and they can update the contracts holding the money. It has never been exploited. Ronin had never been exploited either, right up until it was.

No — and this is the finding that reframes the whole category. Reimbursement has tracked the sponsor’s balance sheet, not the bridge’s security. Sky Mavis raised $150m, led by Binance, to repay Ronin. Jump Crypto put 120,000 ETH of its own money into Wormhole’s hole within about a day. Binance halted an entire blockchain to strand the BNB Bridge mint. Where there was no rich sponsor, people simply lost the money: Multichain’s $126m was never repaid to anyone. And in the largest case of all, Poly Network’s $611m came back only because the thief changed his mind. "They made users whole last time" is a measure of somebody else’s generosity, and it is worthless as a prediction.

They are strictly riskier, and neither of them will tell you so. An aggregator gives you the underlying bridge’s trust assumption PLUS its own router contract to trust. LI.FI lost $11.6m in July 2024 and Socket lost $3.3m in January 2024 — to the same root cause, six months apart: a newly added route in their own router draining wallets that had granted it infinite approvals. Neither exploit was a failure of any bridge they route through. The aggregator was the vulnerability. Never grant an infinite approval to a router.

Multichain marketed itself as a decentralised MPC network. When its CEO was detained in China in 2023, the team discovered it had lost access to the MPC nodes entirely — because they were running under his personal cloud account. The "decentralised validator network" was one man’s login. $126 million, never repaid to anyone. And in May 2026, THORChain — a genuinely bonded, genuinely distributed MPC design — was drained by an attacker who simply posted a bond, joined the validator set, and attacked the signature scheme from inside it. An MPC committee is only as safe as its ability to keep attackers out of the committee.

For USDC, Circle CCTP supports Polygon PoS as a source chain with standard transfers, which avoids the PoS bridge's multisig. For other tokens, the Polygon PoS bridge is the official route, but its Ethereum contracts are controlled by a 5-of-9 multisig rather than by Ethereum itself. Whichever route you use, confirm the token you will receive on Ethereum and keep some ETH there for gas.

For USDC, use a CCTP-based route: Base, Arbitrum and Solana are all supported, and the USDC you receive is native, not wrapped. For other tokens there is no canonical path, so you are choosing a committee bridge such as Wormhole or an application on LayerZero, each with its own signer set. Read which verifiers secure the specific token before moving a large amount.

For USDC, CCTP, because it moves the issuer's own token and adds no party you do not already trust. For other stablecoins, check whether the issuer mints natively on the destination chain and use its official route if so. A bridged copy carries both the issuer's risk and the bridge's. Our stablecoin ranking covers the issuer side of that trade.

Because the withdrawal is only finalized on Ethereum after the dispute window ends. Arbitrum's bridge shows a countdown of about seven to eight days, then you return and press Claim, paying Ethereum gas to execute it. Until you claim, the funds sit in the bridge's outbox. Keep the transaction link so you can find it again.