DeFi Whales Forget Millions in Northbound Bridge Contracts

According to blockchain intelligence company Arkham, some cryptocurrency addresses have been identified with millions of dollars “stuck” or “forgotten” in at least two major bridge contracts.

Arkham stated in a post on April 22nd: “There are dozens of accounts with 6-7 figure sums stuck in northbound or forgotten contracts,” including wallets linked to Ethereum co-founder Vitalik Buterin, cryptocurrency exchange Coinbase, and some DeFi whales. The company attached two screenshots of transactions to and from the Arbitrum and Optimism bridges to support their case.

Arkham noted that a wallet receiving 50 Ether (ETH) from Buterin has had $1.05 million stuck in the Optimism bridge for the past seven months. According to Arkham’s data, if this address belongs to Buterin, it would represent a small portion of his $789 million cryptocurrency investment portfolio.

Another wallet linked to Bofur Capital, bearing the same name as debtor C, has $1.8 million worth of wrapped Bitcoin (WBTC) stuck in the Arbitrum bridge, unmoved for 27 months, while Thomasg.eth, the founder behind Arrow – a decentralized air transport solution, has 800,000 Ether stuck in the Arbitrum bridge.

Furthermore, Coinbase attempted to transfer $75,000 in USD Coin (USDC) to Ethereum six months ago via the Optimism bridge, but it remains unconfirmed on the Ethereum base layer, Arkham reported.

However, it is possible that the owners of these addresses still have control over the funds and voluntarily chose to keep them there at this time. Cross-chain bridges play a crucial role in blockchain networks like Ethereum, enhancing availability and data security on the base layer and reducing transaction load on layer 2.

However, bridges have become a honeypot for hackers, as they are often automated through smart contracts susceptible to attacks or a highly centralized verification system. For example, the $650 million hack of the Ronin bridge by the Lazarus Group, believed to be backed by North Korea, occurred after the group gained access to 5 of the 9 private keys held by transaction verifiers in March 2022.