Recently, someone asked me again what to fear about cross-chain bridges. To put it simply, there are three main concerns: multi-signature, oracles, and what you see as "waiting for confirmation." Multi-signature may look stable, but it really depends on who is signing and how the keys are stored. If something goes wrong, it can quickly shift from "decentralized" to "group chat management" overnight. Oracles are even more mysterious; feeding incorrect data makes all your on-chain security measures useless. As for "waiting for confirmation," don’t complain about the slowness—it's to leave enough room for rollbacks or reorganizations. Otherwise, you might think the funds have arrived, but in reality, the bridge just fronted the money, and all the risk is in the explosion afterward. Looking back, it’s quite funny—many people seek security by relying on on-chain tagging tools, but tags are lagging and can be misleading. To truly avoid risks, you should focus on fund flows and contract permissions. It’s better to make fewer transactions than to become an experiment.