LabHub

Blog

Cross-Chain Interoperability 2026 Complete Guide - BIFROST · LayerZero v2 · Wormhole · Axelar · Cosmos IBC · Polkadot XCM · Chainlink CCIP · Hyperlane Deep Dive

2026-05-16 · 18 min read · #cross-chain#bifrost#layerzero#wormhole#axelar#cosmos#ibc#polkadot#xcm#chainlink-ccip#hyperlane#bridge-security#defi#modular-blockchain

한국어English日本語

Intro — May 2026, bridges hide behind verifier networks and intent protocols

The history of cross-chain bridges is the history of hacks. Poly Network 611Min2021,Ronin611M in 2021, Ronin 625M in 2022, Wormhole 326M,Nomad326M, Nomad 190M, Harmony Horizon $100M, Multichain roughly $130M in 2023 followed by effective collapse — a cumulative $2.8B vanished from bridges. Half of the top ten on the rekt.news leaderboard are bridges.

So by May 2026 cross-chain has solidified along two tracks. One is light-client or validator-network message passing (LayerZero v2 DVN, Wormhole guardians, Axelar GMP, Hyperlane ISM, Chainlink CCIP, Cosmos IBC, Polkadot XCM, Hyperlane permissionless validators), the other is intent-based fast execution with eventual settlement (Across, Squid, UniswapX cross-chain, CoW Swap CCT, deBridge DLN). In Korea, BIFROST Network drives EVM-compatible multichain DeFi anchored by its BFC token and the BiFi protocol. This article looks not at marketing but at trust models, validator sets, hack history, TVL, and EigenLayer AVS integration honestly.

Bridge taxonomy — five models cleanly separated

Do not lump bridges into a single line. Trust assumptions differ completely. As of May 2026 there are five meaningful models.

  1. Light client / native verification: directly verifies the consensus of the counterparty chain. Cosmos IBC, Polkadot XCM, NEAR Rainbow Bridge are representative. The weakest trust assumption but expensive to implement.
  2. External validator set (M-of-N): an outside committee attests messages by majority. Wormhole (19 guardians), Axelar (about 75 validators), the old Polygon zkEVM Bridge, Ronin (9 validators with 5/9 keys stolen in 2022).
  3. Optimistic verification: a message is sent first and can be challenged during a dispute window. Nomad was the standard-bearer and effectively dead after the August 2022 $190M exploit. Across uses UMA Optimistic Oracle only at settlement.
  4. Liquidity pool / mint-burn hybrid: pools on both sides do lock-and-mint or burn-and-mint. Stargate, Hop, Synapse, Connext. Capital-inefficient but fast UX.
  5. Intent / cross-chain solver: the user signs only an intent and external solvers fill assets on both sides, settling later. Across v3, UniswapX cross-chain, CoW CCT, deBridge DLN, Squid Router, Sockets Bungee, 1inch Fusion+.

LayerZero v2, Chainlink CCIP, and Hyperlane sit one tier up as "general message passing (GMP) plus routing" — they carry arbitrary read/write messages, not just assets.

Trust models — 1-of-N, M-of-N, N-of-N

The essence of bridge security is "how many do you have to bribe to steal funds."

Vitalik Buterins January 2022 essay "the multi-chain future, not cross-chain" still resonates here. Because the 51% attack zone of sovereignty differs, assets are safe only at the security of their origin chain and the bridge itself demands extra trust.

BIFROST Network — multichain DeFi infrastructure born in Korea

BIFROST Network is an EVM-compatible L1 plus multichain middleware that Korean firm PiLab Solutions has been building since 2018. As of May 2026:

What makes it meaningful in Korea is that it is not a single-chain token but multichain infrastructure built by Korean engineers, and it remains KYC-friendly even after the first stage of the FSCs Virtual Asset User Protection Act took effect in July 2024. BFC is a listed coin and thus regulated, but the BIFROST chain itself is EVM-compatible and reachable directly from MetaMask.

Below is a simplified BiFi lending pool interface.

// BiFi-style cross-chain lending pool (simplified)
// SPDX-License-Identifier: Apache-2.0
pragma solidity ^0.8.20;

interface IBiFiPool {
    struct UserAccount {
        uint256 deposit;     // underlying units
        uint256 borrow;      // underlying units
        uint256 lastUpdated; // block timestamp
    }

    event Deposit(address indexed user, uint256 amount, uint16 srcChainId);
    event Borrow(address indexed user, uint256 amount, uint16 dstChainId);
    event Repay(address indexed user, uint256 amount, uint16 srcChainId);

    function deposit(uint256 amount, uint16 srcChainId) external;
    function borrow(uint256 amount, uint16 dstChainId, address to) external;
    function liquidate(address borrower, uint256 repay, address collateralAsset) external;

    function getAccount(address user) external view returns (UserAccount memory);
    function utilizationRate() external view returns (uint256); // 1e18 scale
}

srcChainId and dstChainId arrive through an external message relay (the Bifrost Relayer). This pattern is now standard not only for BIFROST but for LayerZero-based dApps.

Polkadot — shared security and XCM v3/v4

Polkadots interoperability is a different model. Because every parachain shares the relay chains validator pool, messages between parachains have no external validator. XCM (Cross-Consensus Message Format) v3/v4 is the message format.

XCM messages are sequences of instructions. Representative ones:

A JSON-like XCM example:

{
  "V3": [
    { "WithdrawAsset": [{ "id": { "Concrete": { "parents": 0, "interior": "Here" } }, "fun": { "Fungible": "1000000000000" } }] },
    { "BuyExecution": { "fees": { "id": { "Concrete": { "parents": 0, "interior": "Here" } }, "fun": { "Fungible": "1000000000000" } }, "weight_limit": "Unlimited" } },
    { "DepositAsset": { "assets": { "Wild": "All" }, "beneficiary": { "parents": 0, "interior": { "X1": { "AccountId32": { "network": null, "id": "0x..." } } } } } }
  ]
}

XCM is more expressive than LayerZero messaging because Transact lets you call pallet functions on another chain, not just move assets. The downside is that leaving the Polkadot ecosystem requires a separate bridge (Snowbridge, t3rn).

Cosmos IBC — the oldest light-client standard

Cosmos IBC (Inter-Blockchain Communication) has zero cumulative hacks since mainnet in 2021, validating the most conservative design in the wild. Core ideas:

IBC v2 (Eureka) has been expanding to EVM chains since 2025. ICS-20 covers fungible token transfer, ICS-27 covers interchain accounts (remote signing transactions on another chain), ICS-721 is NFTs.

Example IBC packet structure:

{
  "sequence": 12345,
  "source_port": "transfer",
  "source_channel": "channel-141",
  "destination_port": "transfer",
  "destination_channel": "channel-2",
  "data": "eyJkZW5vbSI6InVhdG9tIiwiYW1vdW50IjoiMTAwMDAwMCIsInNlbmRlciI6Imdvc21vc..." ,
  "timeout_height": { "revision_number": 4, "revision_height": 19000000 },
  "timeout_timestamp": 0
}

The data field is the ICS-20 JSON payload (base64). Relayers (hermes, go-relayer) shuttle header proofs and packet commitments between chains. Verifying only the consensus of both chains without external trust makes it the most optically safe generalizable model.

LayerZero v2 — DVN (Decentralized Verifier Network) architecture

LayerZero launched v1 in 2022 as a 2-of-2 Endpoint + Oracle + Relayer model and switched to the DVN (Decentralized Verifier Network) model with v2 in 2024. As of May 2026 it supports more than 90 chains.

Core of v2:

LayerZeros security assumption is "the DVNs I selected do not all collude." Because the dApp owns the DVN configuration, critics argue it does not enforce a uniform security level.

A canonical LayerZero OApp interface:

// OApp pattern (LayerZero v2)
import { OAppSender, OAppReceiver } from "@layerzerolabs/oapp-evm/contracts/oapp/OApp.sol";
import { MessagingFee, MessagingReceipt } from "@layerzerolabs/oapp-evm/contracts/oapp/OAppCore.sol";

contract MyCrossChainCounter is OAppSender, OAppReceiver {
    uint256 public counter;

    function increment(uint32 dstEid, bytes calldata options) external payable returns (MessagingReceipt memory) {
        bytes memory payload = abi.encode(counter + 1);
        MessagingFee memory fee = _quote(dstEid, payload, options, false);
        require(msg.value >= fee.nativeFee, "fee");
        return _lzSend(dstEid, payload, options, fee, payable(msg.sender));
    }

    function _lzReceive(
        Origin calldata,
        bytes32,
        bytes calldata payload,
        address,
        bytes calldata
    ) internal override {
        counter = abi.decode(payload, (uint256));
    }
}

The dApp only deals with dstEid (endpoint id) and options (gas hint, native drop); DVN selection is preconfigured via OAppConfig.

Wormhole — guardian set and NTT

Wormhole still carries the trauma of February 2022 when 120k wETH (about $326M) was stolen from its Solana-Ethereum bridge (a signature verification bypass in the contract). Since then it has strengthened guardian governance and in 2024 introduced the Native Token Transfers (NTT) standard to make burn-and-mint without wrapping the default.

Wormholes security assumption is "at least 7 of the 19 guardians are honest." Because the threshold is 13/19, bribing 7 enables forgery — and contract-level exploits like the 2022 bug remain a separate risk.

Axelar — GMP and validator staking

Axelar runs its own Cosmos SDK chain plus gateway contracts on external EVM and non-EVM chains to provide GMP (General Message Passing).

Axelar is an integrated security model where dApps do not need to pick validators, but security depends on the market value of AXL. Misbehaving validators get slashed.

Hyperlane — permissionless ISM

Hyperlane appeared in 2023 with the motto "interoperability as middleware." Its differentiator is letting the dApp choose its ISM (Interchain Security Module) directly. Multisig ISM, optimistic ISM, ZK ISM, EigenLayer AVS ISM can be combined plug-and-play.

In 2024 it integrated with EigenLayer AVS, adding a mode that borrows restaked ETH security. Hyperlane allows permissionless deployment so anyone can spin up a Mailbox on a new chain.

Chainlink CCIP — Risk Management Network and ARM

Chainlink CCIP, mainnet since July 2023, aims at the "enterprise standard." Differentiators:

CCIPs security model is "Commit DON + Executive DON + ARM, a triple majority," which is the most conservative. That is one reason SWIFT picked it for its 2023–2024 PoCs.

// CCIP send pattern
import {IRouterClient} from "@chainlink/contracts-ccip/src/v0.8/ccip/interfaces/IRouterClient.sol";
import {Client} from "@chainlink/contracts-ccip/src/v0.8/ccip/libraries/Client.sol";

contract CCIPSender {
    IRouterClient router;
    address feeToken;

    function send(uint64 dstSelector, address receiver, bytes calldata data, address token, uint256 amount) external returns (bytes32) {
        Client.EVMTokenAmount[] memory tokens = new Client.EVMTokenAmount[](1);
        tokens[0] = Client.EVMTokenAmount({ token: token, amount: amount });

        Client.EVM2AnyMessage memory message = Client.EVM2AnyMessage({
            receiver: abi.encode(receiver),
            data: data,
            tokenAmounts: tokens,
            extraArgs: Client._argsToBytes(Client.EVMExtraArgsV2({ gasLimit: 200_000, allowOutOfOrderExecution: false })),
            feeToken: feeToken
        });

        uint256 fee = router.getFee(dstSelector, message);
        return router.ccipSend{ value: fee }(dstSelector, message);
    }
}

dstSelector is CCIPs own 64-bit chain selector, feeToken is LINK or native ETH.

Comparison — six message-passing protocols

ProtocolModelValidatorsHack historyTVL (May 2026)Notes
Cosmos IBCLight clientN/A (per chain)0cumulative ~$10B flowmost conservative
Polkadot XCMShared security~300 validators0relatively lowecosystem-internal only
LayerZero v2DVN multisigdApp-configurable0 directhighest message volumeflexible security config
WormholeGuardian 13/1919$326M in 2022~$3Bwrapping removed via NTT
AxelarPoS validators~750 direct~$800MGMP plus ITS
HyperlanePluggable ISMdApp-configurable0~$300Mpermissionless
Chainlink CCIPDON + ARM triple2 DONs + ARM0~$500Menterprise-friendly

Figures are approximate as of May 2026 from DefiLlama, L2Beat, and each protocols dashboard.

Liquidity-pool bridges — Stargate, Hop, Synapse, Connext

The fast-transfer cohort:

These layer liquidity on top of messaging like LayerZero or CCIP, so security depends on the underlying messaging.

Intent protocols — Across, Squid, UniswapX cross-chain

The trend from 2024 to 2026 is clear. Users sign only an intent ("what I want") not the path ("how"), and solvers fill it quickly and settle later.

Intents are powerful on UX. Downsides are solver-market centralization (a few MEV teams dominate) and settlement security still tied to the underlying messaging.

Security incident chronicle — where the $2.8B went

Major bridge hacks in summary.

Common pattern: multisig/MPC key theft plus contract verification bypass. Light-client models (IBC, XCM) have zero hacks, which is telling.

EigenLayer AVS plus Symbiotic — restaking arrives at bridge security

From 2024 to 2026 EigenLayer became a big variable in bridge security. Restaking lets ETH stakers delegate their validation duty to additional services (AVS, Actively Validated Service).

The point is bridges no longer have to rely on their own token value — they can borrow ETH security. The downside is AVS slashing mechanisms remain not fully battle-tested in 2026.

CAIP-2, SLIP-44, ENS — chain identifier standards

As cross-chain expanded, identifier standards became necessary.

LayerZero eid, Wormhole chainId, Axelar chain name, Chainlink chainSelector — each protocol has its own ID, so a mapping table is mandatory.

Meeting gas abstraction and Account Abstraction

Cross-chain UX evolves alongside ERC-4337 (Account Abstraction).

Cross-chain + AA + intent together define the 2026 user experience. Almost every step finishes with a single signature.

ZK bridges — a new security frontier

Pinning verification to zero-knowledge proofs is maturing.

ZK verification provides stronger cryptographic-soundness security than a 1-of-N honest assumption, but proving is expensive so ROI relative to asset value matters.

Korean regulation — Virtual Asset User Protection Act and bridges

The Korean FSCs Virtual Asset User Protection Act took effect in its first stage in July 2024. Discussion of stage two (2026 onward) is underway. Key impacts:

A Korea-born project like BIFROST has BFC under the law as a listed coin, while the chain itself stays KYC-free EVM. That duality is the gray zone of 2026.

Japanese regulation — JVCEA and the Travel Rule

Japans crypto regulation rests on the Payment Services Act, the Financial Instruments and Exchange Act, and the Travel Rule.

Japans big variable for 2026 is the expected enforcement of stricter segregation of crypto custody plus full implementation of FATF Recommendation 16 (Travel Rule) by country. Cross-chain plus exchange integration becomes harder.

Indexing — TheGraph, Subsquid, and Goldsky tying cross-chain data together

A cross-chain dApp needs multichain indexing too.

A bridge transaction spans four steps across multiple chains — origin send, destination commit, validator commit, relayer execute — so multichain joins are mandatory.

Dev setup — Foundry, Hardhat, Anchor

If you build a cross-chain dApp, add multichain plugins to the tools you already know.

Fork tests are mandatory. forge test --fork-url $ETH_RPC plus a fork of the destination chain. LayerZero ships a mock endpoint via lz-evm-protocol-v2.

# Foundry multichain fork-test setup
forge install LayerZero-Labs/devtools
forge install smartcontractkit/ccip
forge install OpenZeppelin/openzeppelin-contracts

# Environment variables
export ETH_RPC=https://eth.llamarpc.com
export ARB_RPC=https://arb1.arbitrum.io/rpc
export BIFROST_RPC=https://public-01.mainnet.bifrostnetwork.com/rpc

# Run tests
forge test --fork-url $ETH_RPC --match-contract CrossChainTest -vv
forge test --fork-url $BIFROST_RPC --match-contract BiFiTest -vv

MEV and cross-chain — atomic vs eventual

Cross-chain is fundamentally non-atomic. The origin commit and destination execute are decoupled, leaving room for MEV.

The 2026 solver market is dominated by five to seven firms (Anton, Wintermute, Flashbots, Pyth, GSR). Decentralization is in progress.

Index tokens and LSTs across chains

The multichain rollout of staking tokens is another big topic.

When LSTs and LRTs scatter across chains, synchronization and slash protection get hairy. Burn-and-mint standards like NTT reduce wrapping pileups.

Practical checklist — launching a new cross-chain dApp

Finally, a security and UX checklist for launching.

  1. Pick messaging: choose among LayerZero, CCIP, IBC, Hyperlane, Axelar, Wormhole by trust assumption and cost matrix. If dApp TVL exceeds $10M, multi-routing.
  2. DVN / ISM config: at least 3-of-5 with different operators. No two validators sharing the same key infrastructure.
  3. Rate limits: per-lane and per-token capacity. Chainlink CCIP ships them by default; elsewhere implement them yourself.
  4. Pause + circuit breakers: auto-pause on abnormal patterns.
  5. Replay protection: nonces plus message hashes. All protocols ship this, but verify it yourself.
  6. Gas / native drop: fallback when the destination lacks gas.
  7. Front-end UX: estimated send/arrival times, in-flight status (commit→relay→execute), refundability.
  8. Monitoring: alarms on abnormal traffic via Tenderly, OpenZeppelin Defender, Forta.
  9. Legal: KYC, sanctions screening (Chainalysis, Elliptic), Travel Rule compatibility.
  10. External audits: Trail of Bits, Sigma Prime, OpenZeppelin, Spearbit. On every change.

References

Comments

No comments yet.

Sign in to leave a comment