Two ways to do this, and the choice decides everything that follows. You can pick a bridge because the UI looks friendly and the gas estimate looks small, or you can pick one because the routing, the validator set and the asset coverage are all things you can verify before you sign. The friendly UI option usually wins the first time. It also usually loses money within a year. I learned this the slow way, and the post exists so I do not have to relearn it.
The job of a crypto bridge is the part people skip past. It moves a token from one chain to another by locking it on the source side and minting a wrapped version on the destination, or by burning and releasing across chains. That is fine. The problem is not the concept. The problem is that the moving parts underneath are uneven, and the second move is where the unevenness shows up.
Here is the short list I run through before I touch a new one. Five things, in the order I check them, each one a single concrete step rather than a vibe.
- Read the audit report, not the badge. The badge on the landing page links to a PDF. Open the PDF. Count how many of the findings marked critical or high are listed as resolved in the appendix, not just acknowledged. If the appendix is missing, or the resolver is a GitHub username with three commits, treat the bridge as unaudited for your purposes.
- Find the validator set and count it. A multisig with 4 of 7 signers is not the same product as a multisig with 12 of 19, and neither is the same as a ZK-light-client path that does not need external signers at all. The shape of the security model tells you what failure looks like, and a bridge that hides its shape is telling you something already.
- Check the asset list against two sources. Pull the supported tokens from the bridge itself, then pull them from a chain explorer on each side. Tokens that exist on one list and not the other are wrapped by a third party, and a wrapped-by-a-third-party version is a different asset with different liquidity and a different redemption path. I want to know which one I am getting before I click.
- Look at the last 90 days of TVL, not the all-time chart. A bridge that has held between 40M and 60M for three months is a different risk from one that spiked to 200M last April and has bled since. Big slow declines are usually a liquidity story. Sudden cliffs are usually a security story. I want the chart that shows me which one I am looking at.
- Run a test transfer before the real one. Five dollars worth of the cheapest supported token, sent both directions, with the tx hashes saved. If the test takes more than ten minutes end to end, or the explorer shows it routing through a contract I cannot name, the real transfer is not happening today.
That is the whole list. None of it requires a paid tool, and the whole run takes about twenty minutes on a new bridge. The cost of skipping it is paid by the people who skip it, in the specific currency of learning the same lesson twice.