Bridge, Wrapped Asset and Cross-Chain Dependency Governance requires that AI agents operating across multiple blockchain networks correctly evaluate and manage the risks introduced by cross-chain bridges, wrapped assets, and cross-chain protocol dependencies. Bridges — infrastructure that transfers value between blockchains — introduce unique systemic risks: they aggregate vast pools of locked assets, they rely on validator sets or multisig schemes that may be smaller and less secure than the chains they connect, and they create dependency chains where the failure of a single bridge can affect assets across multiple networks. Wrapped assets (tokens representing assets locked on another chain) inherit the risk profile of the bridge that created them, meaning that an agent holding "WBTC" is not holding Bitcoin but rather a claim on Bitcoin mediated by a custodial bridge infrastructure. This dimension mandates that agents evaluate bridge security, track wrapped asset collateral integrity, enforce cross-chain exposure limits, and maintain governance continuity when bridge infrastructure fails or is compromised.
Scenario A — Bridge Exploit Exposure Through Wrapped Assets: An AI treasury agent manages a portfolio that includes 2,000,000 USDC and 5,000 WBTC (Wrapped Bitcoin). The agent treats WBTC as equivalent to BTC for risk management purposes — same volatility model, same price feed, same counterparty risk classification. A vulnerability is discovered in the WBTC bridge's proof verification logic (analogous to the Wormhole exploit of February 2022 where $320 million was stolen through a signature verification bypass). An attacker mints 120,000 unbacked WBTC. The total WBTC supply is now inflated by 120,000 tokens with no corresponding BTC backing. The WBTC price depegs from BTC, falling from $44,000 to $31,000 within 4 hours as the market prices in the undercollateralisation. The agent's 5,000 WBTC position loses approximately $65 million in value (from $220 million to $155 million). The agent's risk model did not account for bridge-specific depegging risk.
What went wrong: The agent treated a wrapped asset (WBTC) as identical to its underlying asset (BTC) without accounting for bridge risk. WBTC is not BTC — it is a claim on BTC mediated by the bridge's custodial infrastructure. The bridge's security properties (validator set size, proof mechanism, audit history, bug bounty coverage) determine the wrapped asset's integrity. The agent had no mechanism to monitor bridge health, detect supply anomalies, or apply a bridge risk premium to wrapped asset valuations. Consequence: approximately $65 million in mark-to-market losses from bridge exploit contagion, portfolio risk model invalidated, potential forced liquidation of WBTC-collateralised positions.
Scenario B — Cross-Chain Sanctions Screening Gap: An AI agent processes a cross-chain transfer: a user deposits 500 ETH on Ethereum into a bridge contract, and the bridge mints 500 bridged-ETH on an L2 network. The agent screens the user's Ethereum address (per AG-193) — the address is clean. The agent does not screen the bridge contract's deposit pool, which contains 200 ETH from 3 OFAC-sanctioned addresses commingled with 15,000 ETH from non-sanctioned depositors. When the user receives 500 bridged-ETH on the L2 and subsequently transfers it to a regulated exchange, the exchange's compliance system traces the bridged-ETH back to the bridge deposit pool and identifies the sanctioned commingling. The exchange freezes the funds pending investigation.
What went wrong: The agent screened the immediate counterparty but did not evaluate the bridge deposit pool's composition. Cross-chain transfers through bridges commingle funds from multiple depositors. The bridge's deposit pool may contain sanctioned funds that contaminate all bridge-minted tokens. The agent had no mechanism to evaluate the sanctions profile of the bridge's collateral pool. Consequence: 500 bridged-ETH frozen at the exchange (approximately $1.6 million), sanctions investigation, business relationship disruption, and legal costs.
Scenario C — Bridge Validator Compromise and Cascading Failures: An AI DeFi agent operates across Ethereum and three L2/sidechain networks, using bridges to move liquidity where yields are highest. The agent has positions worth a combined $12 million distributed across the four networks, with approximately $8 million dependent on a single bridge infrastructure for cross-chain settlement. The bridge uses a 5-of-8 multisig validator scheme. Three validators are compromised through a supply chain attack on their key management software. The attacker now controls 3 of 8 validators — insufficient to sign fraudulent transactions (which requires 5) but sufficient to halt the bridge by refusing to sign legitimate transactions (3 validators withholding prevents reaching the 5-of-8 threshold). The bridge halts. The agent's $8 million in cross-chain positions cannot be rebalanced, exited, or liquidated. Liquidity pools on the destination chains begin to depeg as the bridge-minted tokens can no longer be redeemed for their underlying assets. The agent's positions lose approximately $2.4 million (30%) over 48 hours due to liquidity fragmentation and bridge-token depegging.
What went wrong: The agent had no awareness of bridge validator set composition, no monitoring for bridge liveness, and no exposure limits on single-bridge dependency. The $8 million concentration on a single bridge exceeded any reasonable risk tolerance. The agent had no contingency procedures for bridge halts — no alternative exit routes, no hedging positions against bridge failure, and no pre-authorised manual intervention procedures. Consequence: $2.4 million in losses from bridge-dependent position depreciation, 48 hours of inability to manage affected positions, and ongoing risk until bridge operations resume.
Scope: This dimension applies to all AI agents that interact with cross-chain bridges, hold wrapped assets, use cross-chain messaging protocols, or maintain positions across multiple blockchain networks. The scope includes agents that: deposit assets into bridge contracts; receive bridge-minted tokens on destination chains; hold wrapped assets (WBTC, bridged USDC, wrapped ETH variants, or any token representing a claim on an asset locked on another chain); use cross-chain messaging for governance, oracle data, or operational coordination; or depend on bridge infrastructure for liquidity, settlement, or position management. Agents that operate exclusively on a single chain with no bridge interactions, no wrapped asset holdings, and no cross-chain dependencies are excluded. The scope extends to indirect bridge dependencies: an agent holding a DeFi position that uses a wrapped asset as collateral has a bridge dependency even if the agent did not directly interact with the bridge.
4.1. A conforming system MUST maintain a bridge dependency registry enumerating all bridges on which the agent's operations depend, including: bridge name and identifier, bridge type (lock-and-mint, burn-and-mint, liquidity pool, optimistic, ZK-proof-based), validator/operator set composition, security model, total value locked (TVL), and audit status.
4.2. A conforming system MUST enforce per-bridge exposure limits that cap the agent's total exposure to any single bridge infrastructure (direct holdings of bridge-minted tokens plus indirect exposure through positions using bridge-minted tokens as collateral or liquidity).
4.3. A conforming system MUST distinguish wrapped assets from their underlying assets in risk modelling, applying a bridge risk premium that accounts for the probability of bridge failure, depeg, or exploit.
4.4. A conforming system MUST implement bridge liveness monitoring that detects bridge operational failures (transaction processing halts, validator unavailability, abnormal latency) and triggers protective actions (position hedging, exposure reduction, human escalation) within a configurable response time (default: 30 minutes from detection).
4.5. A conforming system MUST, before initiating any cross-chain transfer through a bridge, verify: (a) the bridge contract addresses on both source and destination chains match the expected addresses in the bridge dependency registry; (b) the bridge is currently operational (processing transactions within normal latency parameters); and (c) the transfer amount does not cause the agent's exposure to the bridge to exceed the per-bridge exposure limit.
4.6. A conforming system MUST implement wrapped asset collateral integrity monitoring that tracks the ratio of bridge-minted tokens to locked collateral and triggers alerts when the ratio deviates from 1:1 (or the bridge's designed backing ratio) by more than a configurable threshold (default: 1%).
4.7. A conforming system SHOULD implement bridge validator/operator set monitoring that detects changes in the bridge's validator set composition (additions, removals, key rotations) and evaluates the impact on bridge security (e.g., reduction in the number of independent validators below a minimum threshold).
4.8. A conforming system SHOULD maintain contingency exit routes — alternative paths for asset repatriation that do not depend on the primary bridge — for positions exceeding a configurable value threshold (default: $500,000 equivalent).
4.9. A conforming system SHOULD evaluate the sanctions compliance posture of bridge infrastructure, including whether the bridge implements deposit screening, whether the bridge's liquidity pools contain sanctioned funds, and whether bridge-minted tokens carry sanctions contamination risk from pool commingling.
4.10. A conforming system MAY implement cross-bridge arbitrage detection that identifies and flags pricing discrepancies between the same wrapped asset issued by different bridges, which may indicate an exploit or depeg event on one of the bridges.
Cross-chain bridges are the most attacked infrastructure category in blockchain. Between 2021 and 2024, bridge exploits accounted for over $2.5 billion in losses — more than any other category of crypto exploit. The Ronin Bridge ($625 million, March 2022), Wormhole ($320 million, February 2022), Nomad ($190 million, August 2022), and Multichain ($130 million, July 2023) represent only the largest incidents. The attack surface is structural: bridges aggregate large pools of locked assets (Ronin held $625 million in a 5-of-9 multisig), their validator sets are typically smaller and less decentralised than the chains they connect, and their code must implement complex cross-chain verification logic that is difficult to audit comprehensively.
For AI agents, bridge risk creates a category of exposure that is invisible if the agent treats wrapped assets as interchangeable with their underlying assets. An agent that holds 5,000 WBTC and models it as "5,000 BTC" has made an implicit assumption that the WBTC bridge is perfectly secure, perfectly liquid, and will never fail. This assumption is empirically false. WBTC trades at a persistent discount to BTC during periods of bridge uncertainty. Wrapped stablecoins depeg when bridge exploits create undercollateralisation. Bridge-minted tokens become unredeemable when bridges halt operations.
The meta-governance nature of AG-197 reflects that bridge risk does not fit neatly into a single existing governance category. It intersects with: settlement integrity (AG-011) because bridge failures can prevent settlement; finality governance (AG-196) because cross-chain finality requires coordination between chains with different finality models; sanctions screening (AG-193) because bridge deposit pools commingle funds from multiple depositors, including potentially sanctioned ones; and operational boundary enforcement (AG-001) because bridge exposure limits are a form of mandate boundary.
The fundamental principle is that every cross-chain interaction is mediated by bridge infrastructure, and the security of that mediation must be explicitly evaluated and governed — not implicitly assumed. An agent that bridges $10 million through a bridge secured by a 3-of-5 multisig is trusting 3 individuals or entities with $10 million. If the agent's mandate would not permit a $10 million trust exposure to 3 entities in any other context, it should not permit it through a bridge either.
Bridge, wrapped asset, and cross-chain dependency governance requires treating bridges as first-class counterparties in the agent's risk management framework, rather than transparent infrastructure.
Recommended patterns:
Anti-patterns to avoid:
Institutional DeFi Allocators. Institutional funds allocating to DeFi strategies across multiple chains must account for bridge risk in their portfolio construction. A portfolio that is "diversified" across 5 chains but depends on a single bridge for cross-chain settlement is not diversified — it has concentrated bridge dependency. AG-197's per-bridge exposure limits enforce genuine diversification at the infrastructure layer.
Layer 2 Native Protocols. Protocols operating natively on L2 networks that derive their security from the L1 through a bridge/rollup mechanism must account for the rollup bridge's health in their operational risk assessments. A canonical bridge failure on an optimistic rollup could prevent fraud proof submission, undermining the L2's entire security model.
Stablecoin Issuers and Holders. Different instantiations of the same stablecoin on different chains (native USDC on Ethereum vs. bridged USDC on Arbitrum) carry different risk profiles. Native USDC is a direct claim on Circle's reserves. Bridged USDC is a claim on USDC locked in a bridge contract — a double dependency (Circle + bridge). The agent must distinguish between these in risk modelling.
Basic Implementation — The organisation maintains a bridge dependency registry listing all bridges used. Per-bridge exposure limits are defined and enforced. Wrapped assets are distinguished from underlying assets in the portfolio model with a minimum risk premium applied. The agent verifies bridge contract addresses before each cross-chain transfer. This level prevents the most egregious bridge risk exposures but does not provide real-time monitoring or automated response.
Intermediate Implementation — Bridge liveness monitoring operates continuously with automated alerting. Wrapped asset collateral integrity is tracked (bridge-minted supply vs. locked collateral). Bridge validator set composition is monitored with alerts for material changes. Cross-chain finality coordination ensures that cross-chain transfers are not settled until both source and destination transactions achieve finality. Contingency exit routes are documented for positions exceeding the value threshold. Sanctions compliance of bridge infrastructure is evaluated at onboarding and reviewed quarterly.
Advanced Implementation — All intermediate capabilities plus: bridge risk scores are dynamically updated based on real-time metrics (TVL changes, validator participation, latency trends, on-chain anomalies). Cross-bridge arbitrage detection provides early warning of exploit or depeg events. The organisation conducts annual bridge failure tabletop exercises simulating scenarios including: total bridge compromise (full TVL theft), bridge halt (liveness failure), selective censorship (bridge validators refusing specific transactions), and gradual undercollateralisation. The agent's bridge dependency analysis extends to indirect dependencies (e.g., a DeFi protocol the agent uses depends on a bridge-minted token as collateral — the agent's exposure to that bridge includes the indirect protocol dependency). Stress testing quantifies the portfolio impact of simultaneous failure of the top 2 bridges by exposure.
Required artefacts:
Retention requirements:
Access requirements:
Test 8.1: Per-Bridge Exposure Limit Enforcement
Test 8.2: Bridge Contract Address Verification
Test 8.3: Wrapped Asset vs. Underlying Asset Risk Differentiation
Test 8.4: Bridge Liveness Failure Detection and Response
Test 8.5: Collateral Integrity Anomaly Detection
Test 8.6: Cross-Chain Finality Coordination
Test 8.7: Bridge Validator Set Change Detection
| Regulation | Provision | Relationship Type |
|---|---|---|
| EU MiCA | Article 68 (CASP obligations — prudential requirements for cross-chain operations) | Direct requirement |
| CPMI-IOSCO | Principles for FMIs — Principle 17 (Operational Risk), Principle 3 (Framework for Comprehensive Risk Management) | Direct requirement |
| DORA | Article 9 (ICT risk management — third-party dependency) | Direct requirement |
| EU AI Act | Article 9 (Risk Management System) | Supports compliance |
| FCA SYSC | 6.1.1R, 8.1 (Systems and controls, outsourcing) | Supports compliance |
| Basel Committee | BCBS d545 (Prudential treatment of cryptoasset exposures — Group 2b unbacked cryptoassets) | Supports compliance |
MiCA requires CASPs to maintain adequate systems and controls for the crypto-assets they service. For CASPs that handle wrapped assets or facilitate cross-chain transfers, this includes understanding and managing the risks of the bridge infrastructure that creates and redeems wrapped tokens. AG-197's bridge dependency registry and risk scoring directly implement the due diligence that MiCA expects CASPs to perform on the infrastructure they depend upon. MiCA's prudential requirements (Article 76) require CASPs to hold sufficient own funds to cover operational risk — bridge failure scenarios must be included in the operational risk assessment that determines own funds requirements.
Principle 17 requires financial market infrastructures to "identify, monitor, and manage operational risk" including risks from dependencies on external service providers. Cross-chain bridges are external service providers to any agent that depends on them for cross-chain settlement. The principle requires that the organisation "identify and manage the risks its operations might pose to other FMIs, settlement banks, liquidity providers, and service providers." An agent that routes significant volume through a bridge and then withdraws during a crisis may exacerbate bridge instability. Principle 3 requires a comprehensive risk management framework that accounts for all material risks, including concentration risk in infrastructure dependencies. AG-197's per-bridge exposure limits and multi-bridge diversification requirements implement Principle 3's concentration risk management requirement.
DORA requires financial entities to manage risks from ICT third-party dependencies. Cross-chain bridges are ICT third-party services that financial agents depend upon for cross-chain operations. DORA's requirements include: identifying and documenting all ICT third-party dependencies (AG-197's bridge dependency registry); assessing the risks of those dependencies (AG-197's bridge risk scoring); monitoring the performance and availability of third-party services (AG-197's bridge liveness monitoring); and maintaining contingency plans for third-party service failures (AG-197's contingency exit routes). DORA's specific requirements for "critical ICT third-party service providers" may apply to bridges through which the agent routes significant transaction volume.
The Basel Committee's prudential treatment of cryptoasset exposures (finalised December 2022) classifies cryptoassets into two groups. Group 1 includes tokenised traditional assets and stablecoins that meet specified conditions. Group 2 includes all other cryptoassets. Wrapped assets may fall into different groups depending on the bridge infrastructure: a wrapped stablecoin whose backing can be independently verified may qualify for Group 1b treatment, while a wrapped asset with opaque bridge mechanics may receive Group 2b treatment (1,250% risk weight). AG-197's collateral integrity monitoring and bridge risk assessment directly inform the Group 1 vs. Group 2 classification for wrapped assets held by regulated institutions.
| Field | Value |
|---|---|
| Severity Rating | Critical |
| Blast Radius | Multi-chain, potentially systemic — bridge failures can affect all assets on destination chains that depend on the bridge |
Consequence chain: Bridge and cross-chain dependency failures create cascading risks across multiple networks simultaneously. The consequence chain proceeds: (1) Direct exposure — bridge exploit or halt directly affects the agent's holdings of bridge-minted tokens. Historical bridge exploits have resulted in losses exceeding $100 million per incident (Ronin: $625M, Wormhole: $320M, Nomad: $190M). An agent with $10 million in bridge-minted tokens on a compromised bridge faces potential total loss. (2) Depeg contagion — bridge-minted tokens depeg from their underlying assets as the market prices in undercollateralisation or bridge failure risk. Depegs of 10-30% have occurred within hours of bridge incidents. Positions collateralised with wrapped assets face liquidation as collateral values fall. (3) Liquidity fragmentation — when a bridge halts, liquidity on the destination chain becomes fragmented. Tokens that could previously be redeemed through the bridge are now stranded. Market makers widen spreads or withdraw. The agent cannot exit positions at reasonable prices. (4) Cross-protocol cascade — DeFi protocols that use bridge-minted tokens as collateral or liquidity are affected. A lending protocol that accepts WBTC as collateral faces a systemic risk event if the WBTC bridge is exploited. Liquidation cascades on the lending protocol can amplify the initial bridge loss. (5) Governance continuity failure — if the agent operates across chains connected by a failed bridge, its ability to maintain consistent state, execute governance actions, and meet compliance obligations is compromised. Sanctions screening results on one chain may be invalidated by bridge-related state changes on another. The aggregate risk is not the sum of individual bridge exposures but the product of their interdependencies — a characteristic that makes bridge risk inherently systemic.
Cross-references: AG-196 (Chain Finality, Reorg and Fork Governance) provides the finality framework that AG-197 extends to cross-chain transfers — a cross-chain transfer requires finality on both source and destination chains. AG-193 (Sanctions and Prohibited Counterparty Exposure Enforcement) intersects with AG-197 where bridge deposit pools commingle funds from sanctioned and non-sanctioned depositors. AG-194 (Rule-Snapshot and Screening-Time Provenance Governance) should record the bridge compliance assessment as part of screening provenance for cross-chain transactions. AG-195 (Cluster-Level Beneficial Ownership and Indirect Exposure Governance) extends to bridge operators and validator sets as counterparties whose beneficial ownership must be assessed. AG-001 (Operational Boundary Enforcement) applies to per-bridge exposure limits as mandate boundaries. AG-011 (Action Reversibility and Settlement Integrity) establishes the settlement integrity principle that AG-197 applies to cross-chain settlement mediated by bridge infrastructure. AG-029 (Credential Integrity Verification) ensures that bridge contract addresses and RPC endpoints used by the agent are themselves integrity-verified. AG-115 (Strong Authentication for Agent-Initiated Value Transfer) ensures that cross-chain transfer signing is authenticated, preventing a compromised agent from initiating unauthorised bridge deposits.