Cross-chain bridges are supposed to be the connective tissue of crypto — the on-ramps that let value move between otherwise-isolated blockchains. Instead, they’ve been its single worst security disaster. In 2022 alone, bridges leaked roughly $2 billion to attackers, according to Chainalysis — around 57% of all crypto losses that year.
That’s not bad luck. Bridges get hacked because of a structural flaw they nearly all share. This is a plain-English autopsy of why, and a look at how a bridgeless cross-chain protocol — Hedera’s CLPR (“clipper”) — tries to remove the root cause entirely. We’ll be honest about what it fixes and what still has to be trusted.
💣 The Anatomy of a Bridge Hack
Almost every bridge works the same way: lock-and-mint. You lock your asset in a smart contract on Chain A, and the bridge mints a “wrapped” copy on Chain B. To come back, you burn the copy and unlock the original.
That locked pot of assets is the problem. It’s a honeypot — a huge, concentrated pile of value sitting in one place, guarded by a small set of keys, validators, or contract logic. Crack any one of those guards and the whole pot is yours. The three most infamous 2022 hacks are each a different way to crack the same kind of guard:
- Ronin (~$600 million). Attackers (linked to North Korea’s Lazarus Group) compromised 5 of the 9 validator keys that authorized withdrawals — several via a single spear-phishing lure. Five stolen keys, and the vault opened.
- Wormhole (~$370 million). A signature-verification bug in a deprecated function let the attacker forge approval for a mint that never had backing. The guard checked the wrong thing.
- Nomad (~$190 million). A botched contract initialization made any message look valid, triggering a chaotic free-for-all where dozens of people copy-pasted the exploit. The guard was effectively switched off.
Different bugs, one pattern.
🎯 The One Root Cause: Concentrated Trust
Strip away the technical specifics and every one of those hacks is the same story: a small number of keys, signers, or lines of contract code stood between attackers and an enormous pool of other people’s money. That’s concentrated trust, and it’s a magnet. When one component guards billions, the incentive to break that one component is overwhelming — and history says attackers eventually do.
You can audit the contract, distribute the keys, add more validators — but as long as there’s a custodian holding a honeypot in the middle, you’ve only made the single point of failure harder to reach, not gone.
🔓 How a Bridgeless Protocol Removes the Honeypot
Hedera’s CLPR takes a different swing at the problem: delete the middleman. Its own description is a protocol for moving tokens and data between chains “without bridges, pooled liquidity or intermediary validator networks.”
Instead of locking your asset with a custodian and minting a copy, the two ledgers verify each other’s state directly using two cryptographic tools:
- State proofs. The source ledger produces a cryptographic proof that something genuinely happened on it (say, “these tokens were burned”). The destination ledger checks that proof against the source chain’s own consensus — it doesn’t take a middleman’s word for it.
- Threshold signatures (TSS). Authorizations require many independent signers to cooperate, so no single stolen key can act alone — directly targeting the failure that sank Ronin.
The crucial security property: the transfer endpoints hold zero custody of assets. They pass proofs, not funds. There’s no pool to drain because no one is holding a pool. Hashgraph’s framing is that the security question collapses back to “do you trust each chain’s own consensus?” instead of “do you trust this third thing in the middle?” If an endpoint even goes offline, the worst case is a pause — and any party, including you, can resubmit the proof to finish the transfer. No operator can permanently seize your funds.
🧩 What Still Has to Be Trusted (The Honest Part)
A bridgeless cross-chain protocol does not mean “trustless magic.” The trust moves; it doesn’t vanish. With CLPR you’re now trusting two things:
- Each participating chain’s own consensus — reasonable, since you were already trusting those chains to hold your assets.
- The CLPR verifier code and contracts that check the proofs on each side.
That second one matters, and to its credit, Hashgraph names it directly — flagging “bugs in verifier contracts” as a real risk that requires independent audits. Think about what that means: a bug in a CLPR verifier would be a new attack surface, conceptually similar to Wormhole’s verification flaw — just relocated. A few honest caveats worth stating plainly:
- The exact TSS setup (how many signers, how keys rotate) isn’t publicly documented yet, so “no single point of failure” is currently a design claim, not something outsiders can independently verify.
- As of mid-2026, no public third-party security audit of CLPR has surfaced. It’s in closed beta with no production track record.
None of this means CLPR is insecure. It means it’s new, and new plus unaudited is a category to respect, not to hype.
⚖️ “aBFT In, aBFT Out” — and the Weak-Link Caveat
CLPR is designed to preserve each chain’s native security rather than dilute it: where both ledgers use aBFT consensus (asynchronous Byzantine Fault Tolerance — the strongest known class, which Hedera provides), Hashgraph says the cross-ledger protocol “is also aBFT.” A transfer between two strong chains stays strong.
But security is a chain only as strong as its weakest link. Bridge to a chain with weaker, probabilistic finality — Ethereum, say — and that leg inherits the weaker chain’s assumptions. The documentation doesn’t yet spell out exactly how mismatched-finality pairs are handled, so treat the clean “aBFT in, aBFT out” story as true for aBFT-to-aBFT transfers and an open question elsewhere.
🛡️ So Is CLPR Actually Safer Than a Bridge?
Honest verdict: a bridgeless cross-chain protocol attacks the right root cause. By removing the custodial honeypot and the concentrated-trust guard that every major bridge hack exploited, CLPR eliminates the specific failure mode responsible for billions in losses. That’s a genuinely better design.
But “better design” and “battle-tested” are different things. CLPR is early, closed-beta, and not yet independently audited, and it introduces its own new surface in the verifier code. The fair conclusion for 2026: CLPR is a promising answer to crypto’s most expensive problem — architecturally sound, but still to be proven at scale. Watch for the audits.
❓ Frequently Asked Questions
Why do so many crypto bridges get hacked? Because most lock a large pool of assets guarded by a small set of keys or contract logic — a honeypot. Compromise that one guard (as in Ronin, Wormhole, and Nomad) and you take the whole pool.
What makes CLPR a “bridgeless” cross-chain protocol? It has no locked liquidity pool and no custodian in the middle. The two ledgers verify each other’s state directly with cryptographic proofs, so there’s no honeypot to steal.
Does bridgeless mean trustless? No. You still trust each chain’s consensus and the correctness of CLPR’s verifier code. The trust moves; it doesn’t disappear — and verifier bugs would be the new risk.
Has CLPR been hacked or audited? As a new closed-beta protocol it has no public exploit history — but also no publicly cited independent security audit yet. Treat its security claims as promising but unproven.
Is it safe to bridge to Ethereum with CLPR? The strong “aBFT in, aBFT out” guarantee only holds when both chains are aBFT. A leg to a weaker-finality chain inherits that chain’s weaker assumptions.
📚 Further Reading
- What Is Hedera’s CLPR? The Bridgeless Cross-Ledger Protocol Explained — the plain-English foundation.
- Decentralized Computing with Hedera Hashgraph — the aBFT consensus that underpins the finality claims here.
- HBAR Coin Economics — how value and fees work on the Hedera network.
Part of LearnInternetGrow’s series on Hedera Hashgraph and the Cross-Ledger Protocol.