Eight cross-chain bridge exploits in the first five months of 2026. Cumulative losses tracked by PeckShield through mid-May: $328.6 million. DeFi-wide, the total crossed $840 million across more than 50 incidents, a 70 percent year-over-year increase. Three numbers define the pattern. $21.94 billion. Bridge TVL as of March 2026. Every bridge that custodies wrapped assets across multiple chains becomes a single point of failure for every protocol downstream. One compromised validation path and the entire reserve is exposed. $2.8 billion. Cumulative bridge exploit losses since 2022. Bridges alone represent roughly 40 percent of all value hacked in Web3. This is not a seasonal spike or a lapse in operator diligence. The category produces the largest individual losses in crypto year after year because the architecture concentrates risk at a point it cannot defend. $577 million. Two attacks, Kelp DAO and Drift, in a single month. April 2026 was the worst month in DeFi history. In both cases, the breach traced to cross-chain messaging infrastructure, the handoff layer between chains that validates whether a destination-chain instruction should execute. None of this suggests bridges are too complex to secure. It suggests the verification function is too critical to embed inside the same architecture that holds the funds. When a bridge must simultaneously custody assets and validate cross-chain messages, the attack surface collapses into a single point. Treating verification as independent infrastructure, an auditable plane decoupled from custody, is how that surface separates into defensible layers. Sources: 1. https://t.co/2cpNnrCAGB 2. https://t.co/hrQ9rPu7ay #DeepSafe #CRVA #AISecurity #BridgeSecurity #DeFi