Another bridge exploit hit $292M this week. Same pattern as the last several: the cross-chain messaging layer failed, and the bridge released funds it should not have released.
Here is where the bridge industry is right now.
Fully decentralized bridging is the right long-term goal. A trust-minimized bridge where no single party can compromise the system is what the industry should be building toward. But the technology is not there yet. Every "decentralized" bridge architecture shipped to date still depends on a small set of off-chain verifiers, oracles, or relayers. When one of those fails, the bridge fails.
The list is long enough. Ronin. Wormhole. Nomad. Multichain. Orbit. The common thread: a small verifier set was trusted with more value than it could defend.
Until the technology matures, the most secure bridge design is the one the industry is least enthusiastic about naming out loud: centralized custody run by reputable operators with institutional security standards.
That is what ChainPort is built on.
Up to 5% of bridged assets sit in the hot bridge contract. The remaining 98% lives in rebalancing and treasury vaults secured by Fireblocks MPC cold storage and Gnosis multi-sig. When the hot contract needs refilling after heavy outbound volume, the refill is manual and goes through the ChainPort Congress multi-sig. Human approval is required on the cold side before any liquidity moves to the hot side.
The practical effect: an attack on the messaging layer has a cap. An attacker cannot drain what the bridge contract cannot touch, and what it cannot touch requires coordinated approval from multiple holders of hardware-isolated keys.
This is the hot wallet and cold wallet separation that custodial exchanges have used for a decade, applied to the bridge itself.
Decentralization is the goal. Institutional-grade custody is the safest path there.