Cross-chain bridges have become one of the most consequential and most attacked, pieces of infrastructure in the blockchain ecosystem. By some estimates, bridge exploits account for more than
Cross-chain bridges have become one of the most consequential and most attacked, pieces of infrastructure in the blockchain ecosystem. By some estimates, bridge exploits account for more than $2 billion in losses since 2021. The reasons are well-documented: complex multi-chain logic, trusted intermediaries, and smart contract vulnerabilities in high value settlement paths.
The industry has responded with better audits, formal verification, and more rigorous relayer designs. These are necessary improvements. But they address only the present-day threat surface. There is a second security dimension that most bridge architectures have not yet addressed: the quantum computing threat to the cryptographic keys that sign bridge attestations.
When a user moves an asset from chain A to chain B, a bridge performs two operations: it locks or burns the asset on chain A, and it issues a corresponding representation on chain B. Something has to attest that the first event happened before the second can be authorized.
That attestation is a signed message. In most bridge designs, it is signed by a relayer or a set of relayers using standard elliptic-curve keys - the same ECDSA or secp256k1 cryptographic primitives used in Ethereum accounts and Bitcoin transactions.
The security of the bridge is only as strong as the integrity of those keys. If the keys are compromised, bridge attestations can be forged, and assets can be drained. This is not a theoretical risk, it is the mechanism behind several of the largest exploits in the sector.
Not all bridges handle attestation the same way. The field has developed a spectrum of verification mechanisms, each with distinct security properties.
SPV (Simplified Payment Verification) is the most trust-minimized approach available for chains like Bitcoin. A bridge using SPV requires a cryptographic proof, specifically, a SHA256d Merkle inclusion proof — that a transaction was included in a valid block. No relayer can forge this proof. The security derives from the mining network's honest majority, not from any off-chain participant's behavior.
Light-client verification applies to chains with richer finality mechanisms. For Ethereum, this involves verifying sync-committee BLS attestations and Merkle-Patricia-Trie storage proofs on-chain, confirming that a supermajority of validators signed a specific block and that the relevant state is committed to that block's root. For Cosmos-based chains, it involves Tendermint BFT finality proofs and ICS-23 membership proofs. These mechanisms allow a bridge to verify the state of a remote chain without trusting any intermediary to assert it.
Federated verification applies to chains where trustless proof mechanisms are not yet available. Here, a quorum of independent relayers must attest to a cross-chain state transition. The security relies on honest majority within the relayer set — a real and stated assumption, not a cryptographic guarantee. Well-designed federated bridges make this explicit rather than obscuring it.
The gap between these tiers matters. A bridge that applies the same trust model universally across all connected chains is either overstating its security for chains that require federation, or understating its capability for chains that support trustless proofs.
Here is the part of bridge security that has received less attention: all of the verification mechanisms above determine how chain A's state is confirmed on chain B. They do not determine how the bridge's own internal attestations and settlement messages are signed.
If a bridge uses elliptic-curve keys for its validator or relayer signatures — even one operating a trustless SPV or light-client verification model — those signatures are classically vulnerable. An adversary running a harvest-now-decrypt-later strategy records bridge settlement messages today and attempts to decrypt or forge them when quantum hardware matures.
Bridge attestations are particularly attractive targets. They are high-value, time-stamped, and permanently on-chain. They describe asset movements and custody events in detail. An archive of bridge messages from any major cross-chain bridge represents a concentrated record of high-value signed data.
The US National Security Agency has mandated migration to post-quantum standards under CNSA 2.0 by 2030. The US National Institute of Standards and Technology finalized its first post-quantum cryptography standards in 2024. INRIA researchers estimated in 2026 that breaking 256-bit elliptic curve cryptography would require approximately 1,193 logical qubits — a 44% reduction from prior estimates. These are not distant projections; they are institutional planning parameters already in effect.
Applying post-quantum cryptography to bridge attestations means replacing elliptic-curve validator and relayer keys with NIST-standardized post-quantum signature schemes,specifically Falcon, Dilithium (ML-DSA), and SPHINCS+ (SLH-DSA), which completed NIST standardization in 2024.
The practical effect is that every settlement message signed by the bridge is resistant to retrospective decryption. An adversary archiving bridge history today cannot revisit those messages when quantum hardware becomes capable of breaking elliptic-curve keys.
Quantova, a post-quantum Layer-1 blockchain network, applies this approach across its cross-chain bridge infrastructure. The network's bridge spans 36 chains and 68 assets using all three verification tiers - SPV for Bitcoin, light-client proofs for Ethereum and Cosmos-based chains, and federated quorum for chains that do not yet support trustless verification. Post-quantum signing using Falcon-512 and NIST-standardized account-layer schemes is applied on the Quantova side in all configurations, regardless of the verification mechanism used for the connected chain.
The bridge's governance model, requiring ≥80% validator approval, ≥40% stake participation, and a multi-week timelock for configuration changes reflects a broader design principle: security properties that can be unilaterally modified are not security properties.
Cross-chain interoperability is not a niche feature. It is foundational infrastructure for a multi-chain ecosystem. As that infrastructure matures, the security standards applied to bridge attestations will come under the same scrutiny as the smart contracts and consensus mechanisms that have received attention over the past several years.
The quantum dimension adds a new axis to that scrutiny. Bridges that today use classical elliptic-curve keys for attestation are accumulating a historical record that will become retroactively vulnerable if quantum hardware develops on the timelines now being projected by researchers and regulators.
The response does not require waiting for quantum computers to arrive. Post-quantum signature schemes are standardized, implemented, and deployable today. The question for bridge operators and the ecosystems that depend on them is whether to integrate post-quantum signing now, when it is a forward-looking design choice — or later, when it is a reactive mitigation under pressure.
