How we score crypto bridges
Skrumble scores every cross-chain bridge from 0 to 5 on five pillars: Security & Audits (35%), Transaction Speed (20%), Fees (20%), Chains & Tokens Coverage (15%) and Reliability (10%). The overall score is the weighted average, rounded to one decimal. Scores come from audit reports, bridge documentation, public APIs and incident records. The dated sources are listed in our best crypto bridges guide; the individual reviews do not list them yet. We read quotes and routes from public endpoints; we do not move funds across the bridges we review.
What are the five pillars of a bridge score?
A bridge holds or releases funds on two chains at once, so its security design and audit record carry the most weight. Speed and fees share second place because they are what you notice on every transfer. Each pillar gets a score from 0 to 5, set against the evidence in the research file and compared with the other bridges we cover. There is no points table behind a pillar score. It is a judgement on the documented evidence, made relative to the bridges in the table below.
Security & Audits
35% of the scoreHow the bridge secures funds in transit, and how much independent scrutiny that design has had.
What the research checks
- The trust model: who can approve a transfer (a multisig, a validator set, relayers with on-chain proofs, or the underlying rollup's own bridge)
- Published audit reports: the auditor, the date and which contracts were in scope
- Bug bounties and their maximum payouts, from the bounty platform or the team's own page
- Exploits and losses, with dates, amounts and whether users were repaid
- Independent risk write-ups such as L2BEAT's protocol pages
Transaction Speed
20% of the scoreHow long a typical transfer takes to arrive, by route.
What the research checks
- Expected fill or settlement times from the bridge's own quote API for named routes, or from its documentation where it has no public quote API
- Withdrawal delays built into the design, such as rollup challenge periods
Fees
20% of the scoreWhat a transfer costs, all in, on the routes most people use.
What the research checks
- Quotes for a fixed amount on named routes from the bridge's public quote API on a dated day, where it has one; otherwise the fee model in its documentation
- Protocol fees, relayer or liquidity fees and gas on both chains
Chains & Tokens Coverage
15% of the scoreWhich chains and tokens the bridge can route today, not which logos it shows.
What the research checks
- Routable chains and tokens from the bridge's API, app or documentation, compared with its marketing pages
- Whether a route is native or depends on a swap or a third-party path
Reliability
10% of the scoreWhether the bridge keeps working, and how it behaves when it does not.
What the research checks
- Incident and downtime history from the team's status page and announcements
- Signs of a project winding down: governance gone quiet, the app offline, routes switched off
How is a bridge's overall score calculated?
Multiply each pillar score by its weight, then add the five results. Here is the arithmetic for Across Protocol, using the pillar scores published on its review. Its weighted total rounds to 4.5.
| Pillar | Score (0 to 5) | Weight | Contribution |
|---|---|---|---|
| Security & Audits | 4.2 | 35% | 1.470 |
| Transaction Speed | 4.9 | 20% | 0.980 |
| Fees | 4.9 | 20% | 0.980 |
| Chains & Tokens Coverage | 4.1 | 15% | 0.615 |
| Reliability | 4.4 | 10% | 0.440 |
What scores do the reviewed bridges have?
Every scored bridge review, ranked by overall score and read from the same data as the review pages. Bridges we no longer recommend are listed under the table without a score. To compare routes side by side, use the bridge comparison tool.
| Review | Overall | Security & Audits (35%) | Transaction Speed (20%) | Fees (20%) | Chains & Tokens Coverage (15%) | Reliability (10%) | Updated |
|---|---|---|---|---|---|---|---|
| Across Protocol | 4.5 | 4.2 | 4.9 | 4.9 | 4.1 | 4.4 | October 10, 2026 |
| Stargate Finance | 4.1 | 4.0 | 4.4 | 4.0 | 4.2 | 3.8 | October 10, 2026 |
| Arbitrum Bridge | 4.0 | 4.8 | 2.4 | 4.8 | 2.5 | 4.8 | October 10, 2026 |
| Portal Bridge | 3.9 | 3.8 | 3.3 | 4.0 | 4.5 | 4.1 | October 10, 2026 |
| Orbiter Finance | 3.7 | 3.2 | 4.2 | 3.5 | 4.9 | 3.3 | October 10, 2026 |
| Synapse Protocol | 3.3 | 3.2 | 3.5 | 3.5 | 3.5 | 2.5 | October 10, 2026 |
Published without a score: Hop Protocol, Binance Bridge, Orbit Bridge.
How the research works
By Skrumble Editorial · Updated
Where does the evidence for a bridge score come from?
From code, audits and the bridge's own interfaces. Audit reports and bug-bounty pages show what has been checked and what a finder is paid. Documentation describes the trust model. Public APIs show what the bridge can route right now and what a transfer costs. Post-mortems, on-chain analytics and incident write-ups cover what went wrong.
Reading a bridge's API is not a transaction. The research asks for a quote or a route list the same way an app would, and records the answer with its date and time. No funds move.
Other review sites and social posts are never evidence. A claim that only appears there does not appear in our review.
How is each bridge fact checked before it goes live?
New bridge reviews go through four checks, in this order. The paragraph after the example says how far the current reviews got.
- Claim ledger. Every factual statement (fees, dates, licences, incidents, user numbers) goes into a table with its current value, the source URL, the publisher, the source's own date and the date we opened it. We cut any claim that has no fetched source.
- Adversarial challenge. A separate second pass re-opens the sources for every high-stakes item (money, licences, incidents, lawsuits) plus a random 30% of the rest. Where the two passes disagree, the challenge wins.
- Sentence-level QA. On the finished draft, every sentence that states a fact must map to a ledger row or a fetched source. We fix or delete any sentence that does not map.
- 100-point audit. The audit scores the finished page out of 100 on content quality, search optimisation, sourcing and expertise signals, technical structure and how easily search and AI tools can cite it. Below 75, the page does not ship. The target is 85.
What does a catch look like?
Across's homepage listed 28 chains in October 2026. On 9 October 2026 the challenge pass queried Across's own chains API and found 22 routable chains, or 24 counting two swap-only ones; a quote to one of the advertised chains failed. The review says "20+ chains", the figure the bridge could back up.
All nine bridge reviews were refreshed on October 10, 2026 from the research behind our best crypto bridges guide: one claim ledger and one challenge pass covering every bridge. The guide itself then passed the sentence check and the 100-point audit; the individual reviews did not get their own. The methodology overview covers the full process.
Why do some bridge reviews have no score?
Because a score suggests a bridge is usable. When a bridge is abandoned, no longer offered, or has lost user funds that were never recovered, we stop scoring it, put a warning at the top of the review and keep the page for reference. Today that applies to Hop Protocol, Binance Bridge and Orbit Bridge.
People still search for these bridges by name. A clear warning on a dated page is more useful to them than a missing page or a lookalike site.
Do we move funds across the bridges we review?
No. Skrumble does not send transfers through the bridges it reviews. Quotes, routes and fill-time estimates are read from public interfaces and dated; everything else comes from documents.
A quote is the bridge's own estimate at one moment. Your transfer can cost more or take longer if gas prices or liquidity change, so a review gives the date of every quote it uses. A score cannot tell you how your own transfer will go today. It tells you how well the bridge's design protects funds and what has happened to it before.
How often are bridge scores reviewed?
Our target is to re-check every published bridge review at least every six months. These events trigger an earlier check:
- an exploit or a paused bridge
- a contract upgrade or a change to who can approve transfers
- chains or tokens added or dropped
- a fee model change
- signs that a project is winding down
What happens when a bridge review gets something wrong?
Tell us through the contact page, with the claim and the source that contradicts it. We re-open the primary source. If the review is wrong, we correct it, re-check any pillar score the fact feeds, move the review's updated date and record the change and its source in the research file.
Do affiliate deals affect bridge scores?
No. The overall score is calculated from the five pillar scores and nothing else, so commission terms have no way into it. Today none of the nine bridge reviews links out with a referral code. The Visit buttons open the bridges we still recommend' own websites.
No bridge team approves a review before it is published. How Skrumble is funded is set out on how we make money.
Frequently asked questions
Why does Security & Audits carry 35% of a bridge score?
Because a bridge failure usually means lost funds, not a slow transfer. Orbit Bridge lost about $81.5 million at the turn of 2024, and DefiLlama's hacks database records no returned funds. A cheap, fast route is worth nothing if the contracts behind it can be drained.
Does an audit mean a bridge is safe?
No. An audit covers specific contracts at a specific time. Reviews name the auditor and, where the report or the bridge's docs give them, the date and the scope, so you can see how old and how broad each check was.
Did Skrumble test these bridges?
No. Skrumble does no hands-on testing and moves no funds. Quotes and routes come from the bridges' public APIs, dated, and everything else from documents.
How can I check a bridge score myself?
Take the five pillar scores from the review, multiply each by the weight on this page and add them up. The worked example shows the arithmetic. If your total differs from the published score by more than rounding, tell us.
Sources
- [1]Across API: routable chains · Across Protocol · accessed
- [2]Across: protocol risk page · L2BEAT · accessed
- [3]Orbit Bridge exploit: firewall sabotage · The Block · published · accessed
- [4]DeFi hacks and exploits database · DefiLlama · accessed