Anatomy of a Cross-Chain Bridge Exploit: Patterns That Keep Repeating in 2026

TL;DR Cross-chain bridges keep losing money in the same three ways. Ronin Bridge (March 2022, $625M) lost validator keys. Wormhole (February 2022, $325M) accepted a fabricated guardian signature. Nomad Bridge (August 2022, $190M) trusted a zero-init root. None of those were exotic. Each was a single-line invariant a Foundry fork test would have caught before deploy. This walk-through dissects the three recurring classes, shows the fork-test scaffold that reproduces each, and maps the static-anal