Getting Bridges back on Track

Overview

Charles Oskinson argues that recurring cryptocurrency bridge hacks are a systemic security problem caused by bridge trust models—not a flaw in the underlying assets themselves. He contends that bridge thefts are often catastrophic because bridges span multiple on-chain and off-chain components and require complex trust assumptions.

What Bridges Are and Why They Fail

Oskinson offers a structured explanation of bridges and their failure modes:

• A bridge is more than “moving tokens.” It involves many possible state relationships, such as:
  • transaction/block facts,
  • UTXO membership/non-membership,
  • mint/burn behavior,
  • supply and governance actions, etc.
• Bridge operation requires coordinating multiple environments:
  • Cardano on-chain logic (Plutus),
  • BSC on-chain logic (Solidity),
  • off-chain infrastructure (indexers, watchers, proof/receipt handling).
• Common failure points include:
  • incorrect indexing/views of chain state,
  • compromised contracts,
  • weak multisig/threshold controls,
  • admin key upgradability, where a compromised admin could change contract behavior to steal funds.
• He frames bridges as having four main attack surface areas:
  • on-chain contracts on each chain,
  • plus their off-chain supporting infrastructure.

Why Midnight Is Presented as the Solution

Oskinson claims Midnight (Cardano-focused) was designed to close these bridge-security gaps by reducing reliance on bridge operators and increasing reliance on cryptographic verification.

Key ideas:

• Instead of operators relaying/validating state, users generate zero-knowledge proofs that a destination-chain verifier contract can trust.
• This creates a more trustless mechanism:
  • anyone can submit the proof,
  • the contract verifies it,
  • minting/redeeming should not depend on operator honesty.
• He describes “multimodality” bridges that combine:
  • ZK verification for safety properties,
  • threshold signatures / server-side controls for liveness,
  • additional hardening methods such as trusted execution environments and MPC/admin key protection to make admin upgrades harder to compromise.
• Design goal: during an attack, bridges should fail in a way that prevents theft (safety) even if the system becomes unavailable (liveness).

Operational Response and Recovery Concepts

Oskinson also outlines what bridges should do during an attack, not just how to prevent one:

• Attackers may:
  • flood DEX liquidity,
  • move assets into lending/stablecoin positions to hinder exits and launder funds.
• He calls for fast, network-wide “circuit breaker” warning systems so exchanges/DeFi/lenders can automatically pull liquidity or pause operations within seconds/minutes after compromise detection.
• He highlights an exposure asymmetry:
  • wrapped/synthetic assets (e.g., BSC-wrapped tokens) depend on the peg,
  • if invalid redemption is detected, peg redemption can be halted.

“White-Hat” Licensing and Identity for Non-Custodial Recovery

He proposes a legal/operational framework enabling authorized, non-custodial recovery during active attacks:

• A non-custodial wallet may include a “white hat license” at creation time so authorized recovery/best-practice procedures can trigger during an ongoing attack, subject to conditions and a redemption process.
• He argues this requires solving identity and non-repudiation, meaning:
  • proving who controls a wallet,
  • proving the authorization was legally/cryptographically granted.
• He claims Midnight’s tools (e.g., a “passport” / selective-disclosure identity in a ZK system) enable:
  • trustless, private linking between a wallet and an identity,
  • proofs of authorization without exposing plaintext identity details.

Current Incident Framing: “Midnight Isn’t Dead”

Oskinson addresses claims that a recent large bridge hack shows Midnight is ineffective:

• He argues the incident should be seen as evidence for why Midnight is needed, since bridge hacks will likely evolve rather than disappear.
• He claims Midnight itself was not hacked, and that Cardano-side native assets/contracts were not compromised.
• He attributes the failure to:
  • third-party bridge components,
  • the inherent difficulty of building secure bridges using legacy trust models.
• He asserts that formal methods and higher-assurance primitives reduce incident frequency, noting that many Cardano ecosystem issues stem from outside bridge builders or incompetent implementations.

Evidence Cited

He references two main technical contributions:

1. A formal research paper (iaacr.org) claiming the first rigorous formal/UC analysis and model checking of blockchain bridge security properties.
2. A proposal for a trustless ZK bridge between Cardano and Midnight.

Conclusion

Oskinson’s overall message is that bridge hacks are unavoidable when bridges rely on fragile trust assumptions and complex off-chain coordination. He argues bridges should be redesigned around:

• formal security guarantees,
• ZK verification,
• stronger admin protections,
• rapid circuit breakers,
• and a recovery model that works in a non-custodial setting using privacy-preserving identity and authorized “white-hat” procedures.

Presenters or Contributors

• Charles Oskinson (presenter)
• Agalos (mentioned as co-research/teammate; referenced in connection with the formal paper)
• A cross-disciplinary formal methods research team (no individual names listed in the subtitles except the following)
• Dematar Chichv (co-author mentioned)
• Microsoft Research (mentioned as participating; no individual named)
• Microsoft Azure AI researchers (mentioned generally)
• Estonia, France, Scotland teams (mentioned generally; no individuals named)