The short answercBridge is inexpensive and reaches almost everywhere, and its contracts have not been exploited. The 2022 incident was a DNS hijack that redirected users to a malicious front end — a reminder that the interface is part of the attack surface even when the protocol is sound.
Best forCheap transfers across a long chain list
Trust assumptionsweight 30%
6.0avg 7.2
Exploit historyweight 25%
6.5avg 8.8
Settlement speedweight 15%
8.0avg 8.3
Chain coverageweight 15%
8.5avg 8.1
Costweight 15%
8.5avg 8.2
this service category average across 15Score = Σ mark × weight. Works well for a specific use case, weaker outside it. Methodology.
| Criterion | Mark | What we found | Source | Checked |
|---|
| Trust assumptions | 6.0 | not sourced yet | not sourced yet | — |
| Exploit history | 6.5 | not sourced yet | not sourced yet | — |
| Settlement speed | 8.0 | not sourced yet | not sourced yet | — |
| Chain coverage | 8.5 | not sourced yet | not sourced yet | — |
| Cost | 8.5 | not sourced yet | not sourced yet | — |
What we liked, and what fell short
Liked- Low fees across a very wide chain list
- Contracts themselves have not been exploited
- Fast transfers on liquidity-rich routes
Fell short- A 2022 DNS attack on its front end cost users around $240k
- State-guardian network is permissioned
Why the marks landed where they did
Celer's cBridge covers a very wide set of chains at fees among the lowest in the category, using liquidity pools and a state guardian network for verification. Its contracts have operated without a direct exploit.
What happened in 2022
Attackers compromised DNS records and served a malicious front end at the legitimate domain. Users who connected and approved transactions had funds stolen — around $240,000 in total. The contracts were untouched; the website was the vector. Celer restored control, compensated affected users and hardened its DNS and hosting.
Why this matters generally
Front-end compromise is one of the most common ways DeFi users lose money and one of the least discussed. A protocol's audit says nothing about its domain security, and users have no practical way to verify that the interface they loaded is the correct one beyond bookmarking, checking certificates and reading what they sign on a hardware wallet screen.
Security model and cost
The state guardian network is permissioned, which is a weaker assumption than bonded consensus or light clients. Fees run 0.04% to 0.1% and transfers are fast on liquidity-rich routes.
Who should use it
Users needing cheap transfers on a route others do not cover, arriving via a bookmarked URL and verifying transactions on a hardware wallet.
FAQ
Was Celer cBridge hacked?+
Its contracts were not. In 2022 attackers hijacked DNS records to serve a malicious front end, stealing roughly $240,000 from users who approved transactions there.
How do I protect against front-end attacks?+
Bookmark the correct URL, verify what you are signing on a hardware wallet screen, and be suspicious of any interface asking for unusual approvals.
What secures cBridge transfers?+
A permissioned state guardian network, which is a weaker assumption than bonded consensus or light-client verification.
What does cBridge cost?+
Roughly 0.04% to 0.1% plus gas, among the cheaper options across a very wide chain list.
