The Bridge Problem and the Alternative: Moving Value Between Canton and Ethereum

Organizations and individuals increasingly hold tokenized assets in two kinds of places at once. Some sit on permissioned networks built for regulated finance, like Canton. Others sit on public chains, like Ethereum. DTCC's July production trades ran across both a private network and a public one, which is the shape of the market now. At some point value has to move between the two, and the way that move usually happens is the least safe part of the entire system.

The connection between chains is called a bridge, and bridges are where the money goes missing. Chainalysis found that attacks on bridges accounted for 69% of all cryptocurrency stolen in 2022, roughly $2 billion across 13 hacks in that year alone.¹ This piece explains why bridges fail, why the problem is harder for organizations and individuals than the code risk alone, and what a compliant, non-custodial swap does instead.

Why This Matters

Cross-chain settlement is becoming a routine need for organizations and individuals rather than a crypto curiosity. As tokenized assets spread across more than one network, the question stops being whether to hold them on-chain and becomes how to move them between chains without taking on custody risk, counterparty risk, or the code risk that has drained bridges for years. The mechanism a company uses to move value now belongs to its operational risk.

How a Typical Bridge Works, and Why It Breaks

A standard bridge uses a design called lock-and-mint. You send an asset to the bridge on the first chain, the bridge locks it, and it mints a stand-in token on the second chain. What arrives is a claim on the asset, backed by whatever is sitting in the bridge's locked pool.

That locked pool is the weakness. It holds everything users have sent across, which makes it a single, concentrated target. If an attacker finds a flaw in the bridge's code or its validators, the whole pool can be drained at once, and the stand-in tokens on the other side are left backed by nothing. The largest crypto thefts on record have followed this pattern.

For someone moving small amounts, that is a risk to weigh. For an organization or individual moving regulated assets at scale, it is close to disqualifying, because the failure is not gradual. The pool is either safe or emptied.

Why Bridge Security Isn't the Only Problem

Organizations and individuals face additional requirements beyond bridge security... They cannot move value to an unknown counterparty, and they cannot let an intermediary take hold of their assets, even briefly.

A company has to know who is on the other side of a transaction. It has to screen that party, document the screening, and keep an audit trail its compliance team can stand behind. A generic bridge offers none of this. It moves tokens between anonymous addresses and asks no questions, which is the opposite of what a compliance function requires.

There is also the custody question. Any design where an intermediary takes possession of the asset partway through, even briefly, creates exposure to that intermediary failing, being hacked, or being unable to complete the transfer. For assets of that size, that exposure has to be removed at the source.

The Solution: A Non-Custodial Atomic Swap

A non-custodial atomic swap removes the pool and the custody handoff. Instead of locking your asset with an intermediary and issuing a claim, it exchanges value directly between the two parties on the two chains, and it settles atomically.

Atomic means both legs complete together or neither does. There is no in-between state where one party has delivered and the other has not, so neither side is ever exposed to the other failing partway through. Non-custodial means no intermediary ever takes possession of the asset during the swap, so there is no pool to drain and no third party that can fail while holding the value. The two properties work together: because settlement is atomic, there is no need for anyone to hold the asset in the middle, and because no one holds it, there is no honeypot to attack.

Add counterparty screening to those two properties and the problem is addressed for organizations and individuals alike. You know who is on the other side, the assets never leave your control until they settle, and the process produces a record. This is the model the Interstice Digital Cross-Chain Swap Engine implements for movement between Canton and Ethereum. What follows is how it works, in order.

How It Works

Before the Swap: Screening the Counterparty

The first step happens before any value moves. Every counterparty is screened through KYC and KYB, so the identity of the person or business on the other side is established up front rather than assumed.

The company then sees who that counterparty is, at the individual, business, and wallet level, and decides whether to proceed. It can accept the counterparty or reject it. This is the step a generic bridge skips entirely, because a bridge moves value between anonymous addresses and never asks the question. Here, the question is answered first, and the company holds the decision.

The Swap Itself: Atomic and Non-Custodial

Once the company accepts the counterparty, the swap settles atomically. Both legs complete together or the swap does not happen, so neither party is exposed to the other failing partway through.

The swap is also non-custodial. Interstice never takes custody of the assets at any point in the transaction. Value moves between the two parties directly, which means there is no intermediary pool holding the assets and nothing for an attacker to drain. The custody exposure that a bridge introduces is simply not part of the design.

What Assets and Wallets Are Supported

The Cross-Chain Swap Engine settles across USDC, ETH, and Canton Coin, and it supports on-ramping into Canton using ETH or USDC. Solana and Robinhood chain legs will be added soon. So a company holding value on Ethereum can move it into Canton to participate in Canton-based activity, or move value back out, within the same compliant process.

Connection is handled through WalletConnect, which lets a company connect major wallets rather than adopt a new one. The Cross-Chain Swap Engine is recognized as a Featured App on Canton.

What the Cross-Chain Swap Engine Delivers

After the swap, the company has more than a completed transaction. It has a screened counterparty and a record of the movement, which is what a compliance function needs to demonstrate that the transaction was handled correctly.

This is the difference between sending value to an address and running a documented process. The design is meant to support the compliance workflows a company already operates, so the swap fits into how the company works rather than asking it to accept the anonymity and custody exposure a bridge takes for granted.

FAQ

What is a blockchain bridge? A bridge connects two blockchains so value can move between them. Most bridges lock an asset on the first chain and mint a stand-in token on the second, which represents a claim on the locked original.

Why are bridges considered risky? The locked pool of assets behind a bridge is a concentrated target. A flaw in the bridge's code or validator set can drain the pool, leaving the stand-in tokens unbacked. Cross-chain bridge exploits account for a large share of all crypto thefts to date.

How is a non-custodial swap different from a bridge? A bridge locks your asset with an intermediary and issues a claim on another chain. A non-custodial swap exchanges value directly between the two parties and settles atomically, without an intermediary taking custody.

When is the counterparty screened? Before the swap. Every counterparty is screened through KYC and KYB, and the company can see who is on the other side and accept or reject before committing.

Which assets and wallets are supported? Settlement covers USDC, ETH, and Canton Coin, including on-ramping into Canton with ETH or USDC. Wallets connect through WalletConnect.

Conclusion

The move from single-chain to multi-chain finance is already happening, and it has made cross-chain settlement a core function for organizations and individuals. A bridge concentrates assets in a pool and asks the market to trust it. A non-custodial atomic swap removes the pool, screens the counterparty first, and settles directly, so the failure that has cost the industry billions has nowhere to happen. For an organization or individual, the design they choose to move value with is itself a risk decision.

Disclaimer

Interstice Digital publishes this content for informational purposes only. While we work closely with the Canton ecosystem, this post reflects our current understanding based on publicly available sources and may not reflect the most recent developments. Nothing in this post constitutes investment advice, a solicitation, or a recommendation to buy or sell any asset including Canton Coin.

Footnotes

¹ Chainalysis, "Cross-Chain Bridge Hacks Emerge as Top Security Risk," chainalysis.com, August 2022. Bridge attacks accounted for 69% of all cryptocurrency stolen in 2022, roughly $2 billion across 13 hacks that year.

² Interstice Digital, "Cross-Chain Swap Engine," intersticedigital.io. Product overview, including atomic and non-custodial settlement, KYC/KYB counterparty screening, supported assets, and Featured App status on Canton.

³ Interstice Digital, "Cross-Chain Swap Engine documentation," gitbook.io. Product documentation for swap flow, supported assets, and wallet connection.