Ronin. Wormhole. Nomad. Multichain. Roughly $2 billion in bridge exploits, and they all share one structural cause. A committee was bridging two chains that couldn't see each other, and the assets rode on the committee's word alone.
The industry's response has been to build better committees. Bigger multisigs. MPC custody. ZK attestations of the committee's behavior. Every one of these is an attempt to make the committee more trustworthy. None of them removes the committee, which is where the risk actually lives.
The structural flaw every bridge shares
A bridge exists because two chains can't read each other's state. Bitcoin can't see what's happening on an Ethereum L2. Ethereum can't verify a Bitcoin transaction natively. So a bridge inserts a group of people, or a group of signers, who watch both sides and vouch for what happened.
That group becomes the single point of failure. The assets locked on one side are released on the other based on the committee's attestation. Compromise the committee, forge the attestation, and the assets walk. This is true regardless of how the committee is implemented.
Ronin was a five-of-nine multisig. Attackers got five keys and drained roughly $625 million.
Wormhole had a signature verification flaw exploited for around $320 million, letting an attacker forge the validators' approval.
Nomad had a flawed initialization that let anyone spoof valid messages, drained for roughly $190 million in a chaotic free-for-all.
Multichain lost around $1.3 billion in circumstances tied to control of the keys held by the operator.
Different implementations. Different specific failures. Same structure underneath. A committee stood between two chains, and the assets depended on that committee being honest and uncompromised. We've argued that this fragile structure is exactly why 300-plus isolated Bitcoin L2s connected by bridges is a failure rather than a feature.
Why 'better committee' doesn't solve it
Bigger multisigs raise the number of keys an attacker needs, but Ronin shows that key compromise scales with the value at stake. MPC distributes key material, but the committee is still the authority that vouches for cross-chain state. ZK attestations prove the committee behaved according to its rules, but they don't remove the committee's authority over the assets. They prove the committee did what it said, not that what it said should be trusted with billions.
Each improvement makes the committee harder to compromise. None of them changes the fact that a compromise of the committee means assets are gone. You're hardening the single point of failure, not eliminating it.
Delete the committee
Bitcoin-IPC's answer is structural rather than incremental. There is no separate bridge committee.
A subnet's bridge into Bitcoin is controlled by the same validators who run the subnet. There's no second group of people to compromise. The trust set you accepted to use the subnet is the only trust set involved. Nothing extra is bolted on.
Every cross-chain message is a Bitcoin transaction that both sides read directly. Deposits and withdrawals are plain Bitcoin transactions. Each validator independently reconstructs subnet state by reading Bitcoin blocks, rather than relying on a committee's attestation about what happened.
And the blast radius of any compromise is bounded. A rogue subnet can run away with what users deposited into that subnet, because those users trusted those validators when they deposited. That risk is unavoidable and honest. What a compromised subnet cannot do is forge or inflate assets anywhere else in the network. We call this the firewall property, and it's a core design principle of Bitcoin-IPC.
What replaces the bridge isn't a better bridge
The bridge era is ending, and the replacement isn't a more sophisticated committee. It's an architecture where the chains can read each other directly and the people securing the connection are the same people you already trusted.
The $2 billion in exploits wasn't a series of unlucky bugs. It was the predictable result of a structure that put a committee between chains and assets on the committee's word. Remove the committee and you remove the category of failure. That's the difference between hardening a single point of failure and designing it out.
Want to understand how cross-chain transfers work without a bridge committee? Contact us to find out more and explore collaborations.