Trail notes
- A bridge usually locks your tokens on one network and issues a wrapped IOU on another.
- Bridges pool many users’ funds in one place, which makes them large targets.
- Validator or multisig compromise and message verification bugs can strip the backing from every wrapped token at once.
- As of 2026-10-30, CRA has published no guidance on wrapping or bridging, so detailed records matter.
What bridge risk is
Blockchains cannot read each other’s ledgers directly. A bridge is the system that lets you move value from one network to another. Most bridges do it by locking your tokens in a contract on the first network and issuing a matching wrapped token on the second. The wrapped token is an IOU: it is worth the original only while the locked tokens are still there and can be released.
Bridge risk is the chance that the bridge fails, is attacked, or its IOUs stop being honoured. Because one bridge serves many users, a single failure usually hits all of them at once.
We rate bridge risk 5 (extreme) on the Mitey risk scale, our editorial teaching scale inspired by avalanche danger ratings: 1 low, 2 moderate, 3 considerable, 4 high, 5 extreme. It is a general teaching guide, not a rating of any specific bridge, and not advice. We put it at the top because bridges combine smart contract risk, key management risk and the complexity of two or more networks, around large pools of other people’s funds.
How it happens
- Custody concentration. Every token that crosses a lock-and-mint bridge sits in the same contract or wallet. That pool becomes one of the most attractive targets in DeFi.
- Validator or multisig compromise. Many bridges rely on a set of validators or a multisig to confirm that a deposit happened on the other side. If an attacker gains enough of those keys, they can approve fake deposits and release or mint tokens at will.
- Message verification bugs. The bridge contract has to check that a message from the other network is genuine. A bug in that check can let someone forge a message, such as a withdrawal never backed by a deposit.
- Wrapped-asset depegs. If the locked pool is drained or frozen, wrapped tokens on the other network lose their backing. Their market price can fall far below the original asset, even though the original asset itself is fine.
- Liquidity and route risk. Some bridges swap through liquidity pools instead of locking and minting. Thin pools, paused routes or a stalled transfer can leave funds stuck in transit.
- Operational risk. Upgrades, admin keys and front-end websites carry the same problems as any other smart contract, multiplied across networks.
The ethereum.org guide to bridges describes the core trade-off. Trusted bridges depend on an operator or group of signers holding custody; trust-minimized designs lean harder on code and cryptography being correct. Neither is free of risk. Your job is to know which kind you are using and who or what you are trusting.
See the full infographic with notes.
A hypothetical example
These figures are invented to show the mechanism. The lesson is that a wrapped token carries two risks at once: the risk of the asset itself and the risk of the bridge that issued the wrapper.
Warning signs
- A small validator set or multisig, or no clear disclosure of who the signers are.
- Admin keys that can upgrade the bridge or move locked funds without any delay.
- Very large locked balances relative to how long the bridge has operated.
- A wrapped token trading noticeably below the original asset.
- Transfers taking far longer than usual, or routes being paused without explanation.
- Bridge links arriving through ads, direct messages or search results rather than official documentation.
- Several different wrapped versions of the same asset on one network, with unclear origins.
How to reduce it
- Cross less often. Every bridge trip adds risk and fees. Batch your moves and avoid hopping between networks for small gains.
- Don’t park value in wrapped tokens by default. If you bridge to use an app, think about whether you need to keep holding the wrapped IOU once you are done.
- Understand native issuance. Some assets are issued directly on several networks by their issuer. That removes the bridge from the backing, though not the issuer’s own risk.
- Know which version you hold. Check the token contract address against the issuer’s or bridge’s official documentation, not a social media post.
- Send a test amount first. A small transfer confirms the route and address before you move the rest.
- Use the checklist every time. The bridge checklist covers the questions to ask before each crossing, and the bridges guide explains the designs.
Fees on both networks, plus any bridge fee, can eat a small transfer. The bridge costs calculator on our sibling site, linked below, helps you see whether a crossing is worth it.
The Canadian angle
Canadian rules do not change how a bridge works. A bridge contract is code, and there may be no registered firm you can turn to if it fails. Wrapped tokens, like other crypto, are not covered by deposit insurance: CDIC’s “What’s covered” page (checked 2026-10-30) lists cryptocurrencies, including stablecoins, as not covered.
As of 2026-10-30, CRA has published no DeFi-specific guidance on wrapping or bridging tokens. Whether locking one token and receiving a wrapped version is a disposition is not addressed in CRA’s crypto pages. Get advice from a tax professional rather than assuming either answer.
Whatever the tax answer turns out to be, records make it workable. CRA’s records page (modified 2025-11-10) asks crypto users to keep the addresses of each wallet they use and the date, units, CAD value and nature of each transaction. For a bridge crossing, that means both networks, both token contract addresses, the fees and the transaction identifiers on each side.
If a bridge is drained and your wrapped tokens become nearly worthless, how that loss is treated is also something CRA has not specifically addressed. Keep evidence: transaction records, announcements from the bridge operator and the wrapped token’s market price over time.
Your checklist
Questions people ask
Why are bridges riskier than other DeFi contracts?
Bridges concentrate many users’ funds in one place and depend on two or more networks, plus validators or multisigs, all working correctly. A single failure can strip the backing from every wrapped token the bridge issued.
What is a wrapped token?
A wrapped token is a token on one network that represents an asset locked somewhere else, usually by a bridge. It is worth the original asset only while that backing is in place and can be redeemed.
Is bridging a taxable event in Canada?
CRA has not said. As of 2026-10-30 it has published no DeFi-specific guidance on wrapping or bridging, so keep detailed records and ask a tax professional.
How can I tell if a wrapped token is legitimate?
Compare its contract address with the issuer’s or bridge’s official documentation, and check that it trades close to the original asset. Many look-alike tokens use the same name and symbol.
Sources and dates
- Blockchain bridges — ethereum.orgreference
No date shown on page · checked 2026-10-31. How bridges move assets between networks, and bridge risks. - Layer 2 — ethereum.orgreference
No date shown on page · checked 2026-10-31. Rollups and other scaling networks. - Ethereum security and scam prevention — ethereum.orgreference
No date shown on page · checked 2026-10-31. Wallet security habits and common scams. - What's covered — Canada Deposit Insurance Corporationin force
No date shown on page · checked 2026-10-30. Up to $100,000 per category per member institution; cryptocurrencies, including stablecoins, are not covered. - Information for crypto-asset users and tax professionals — Canada Revenue Agencyin force
Page date 2025-10-29 · checked 2026-10-30. CRA's current crypto-asset guidance set (replaced the older 'Guide for cryptocurrency users'). - Keeping books and records of crypto-assets for tax filing — Canada Revenue Agencyin force
Page date 2025-11-10 · checked 2026-10-30. What to record per transaction, wallet addresses, yearly balances; export platform history; keep records at least six years.
Education only. Nothing on this page is financial, investment, tax or legal advice, or a recommendation to buy, sell, stake, lend or borrow any crypto-asset. Crypto-assets can lose some or all of their value and are not covered by CDIC. Canadian rules change: check the dated sources above and talk to a qualified professional about your situation. Full disclaimer.