A white-hat hacker ("0xriptide") found an uninitialized-variable bug in the Ethereum–Arbitrum Nitro bridge contract
Sep 2022outcome unclear- Outcome
- Fixed before exploitation; 400 ETH bounty paid
- Loss
- None
- Recovered or reimbursed
- n/a
The Arbitrum Bridge is the official, or "canonical", route for moving ETH and ERC-20 tokens between Ethereum and the Arbitrum chains, Arbitrum One and Arbitrum Nova 1. Offchain Labs runs the web interface, and the Arbitrum DAO governs the underlying contracts 58. Deposits from Ethereum usually arrive in 15–30 minutes. Withdrawals back to Ethereum take at least seven days, because Arbitrum is an optimistic rollup 1. The bridge is non-custodial and charges no service fee; you pay only network gas 5.
The bridge links a "parent" chain to a "child" chain. For Arbitrum One (chain ID 42161) and Arbitrum Nova (chain ID 42170), the parent is Ethereum 1. The same interface also bridges between Arbitrum One and Arbitrum-based layer-3 chains, and covers the Arbitrum Sepolia testnet 1.
The canonical bridge does not move funds directly to Solana, Polygon, BNB Chain or Optimism. Searches such as "arbitrum to solana bridge" lead to third-party bridges, which carry their own trust models.
For background, see what is a layer 2 and layer 1 vs layer 2.
A deposit locks your asset in a contract on Ethereum, and Arbitrum credits the same amount on the child chain 13. The documented steps 12:
Behind the scenes, a deposit is a "retryable ticket", a message from Ethereum to Arbitrum. If it fails to execute automatically, for example because L2 gas spiked, it can be redeemed manually within one week. You can pay to extend that window. If a ticket expires, the deposited value is refunded to the refund address 3. The Retryable Tickets tool checks and redeems stuck deposits 2.
A withdrawal takes at least seven days, and the interface shows a 7–8-day countdown 1. That window is the challenge period: any validator can dispute a state claim before it is finalized on Ethereum. L2BEAT puts the current challenge period at 6 days 8 hours, extended by 2 days if a claim is challenged 8.
Since February 12, 2025, Arbitrum One and Nova have used BoLD, a dispute protocol that lets anyone validate instead of an allowlist 67. Offchain Labs says BoLD caps how long an attacker can delay confirmations, at roughly 12 days in the worst case 6.
To finish a withdrawal you need two transactions 12:
Arbitrum's docs note that some users choose third-party fast bridges to avoid the wait. These are separate services with their own risks and terms 25.
The Arbitrum Bridge has no published service fee. Offchain Labs states that it receives no share of gas or third-party fees, though its terms reserve the right to charge for services 5.
What you do pay is gas 3:
Ethereum gas dominates both, so costs rise and fall with mainnet congestion. See gas fees explained.
There are two USDC tokens on Arbitrum One, and the bridge route decides which one you receive 4:
| Token | Contract on Arbitrum One | How you get it |
|---|---|---|
| USDC (native, issued by Circle) | 0xaf88d065e77c8cC2239327C5EDb3A432268e5831 |
Circle's CCTP (burn on Ethereum, mint on Arbitrum) |
| USDC.e (bridged) | 0xff970a61a04b1ca14834a43f5de4533ebddb5cc8 |
The canonical lock-and-mint bridge |
Native USDC launched on Arbitrum One in 2023, and Arbitrum expects liquidity to keep moving from USDC.e to native USDC 4. Check which token an exchange or app accepts before you send it.
The bridge's safety rests on Arbitrum's rollup design rather than on a separate validator set. Here is how it is controlled, per L2BEAT as of October 2026 8:
The emergency power is not theoretical. In April 2026 the Security Council moved 30,766 ETH (about $71 million) linked to the Kelp DAO rsETH exploit from an Arbitrum One address to a wallet that only governance can unlock. It acted on law-enforcement input, and the move was widely discussed as an unusual intervention 9.
Phishing is a practical risk too. Use only the official bridge URL, never share a seed phrase with "support", and see crypto phishing.
The interface is open to anyone with a wallet, and there is no account or KYC. Offchain Labs' terms bar use from comprehensively sanctioned regions (Crimea, Cuba, Iran, North Korea, Syria) and by persons on OFAC's SDN list 5. The contracts themselves can be called without the interface.
No exploit draining the canonical Arbitrum Bridge was found in public reporting checked on October 23, 2026.
Hacks in DefiLlama’s public database are also scored as the security record on the Arbitrum Bridge rating page.
How It WorksLayer 1 vs Layer 2, ExplainedLayer 1 is the base blockchain that settles transactions and provides security. Layer 2 is a network built on top of it for faster, cheaper transactions.6 min read·
TechnologyWhat is a Layer-2 and why does it matter?A beginner-friendly guide to Layer-2 networks: what they are, how rollups scale blockchains, and why they matter for fees and speed.8 min read·
RegulationBitcoin ETF Outflows Weigh on Market as Interactive Brokers Launches Ethereum StakingSpot Bitcoin ETFs recorded $65.4 million in net outflows as hawkish Federal Reserve comments pressured prices. Meanwhile, Interactive Brokers rolled out Ethereum staking for eligible US clients.4 min read·
MarketsCFTC Opens Retail Crypto Leverage Rulemaking as Bitcoin Holds Near $84KThe CFTC has begun a rulemaking on leveraged retail crypto trading, while Bitcoin hovers near $84,000 and traders wait for U.S. inflation data and the Fed’s October meeting.4 min read·
MarketsUS Moves $1B in Seized Bitcoin as Senate Scrutiny of Tether GrowsU.S.-linked wallets shifted 12,267 BTC from a Bitfinex hack seizure address without any exchange deposit, while Senator Richard Blumenthal pressed Cantor Fitzgerald over its Tether partnership.3 min read·Related: Circle · What is Ethereum · All company profiles