Recently, someone asked me whether cross-chain bridges can achieve high APY.

Honestly, I usually start by assessing the risks: who manages the multi-signature, what is the signature threshold, and whether there are permissions for "adding/removing people temporarily."
I used to think multi-signature equals security, but I’ve actually seen governance suddenly change the threshold on a whim, which directly reduces security…
And as for oracles, don’t be fooled by the fancy name; essentially it’s about “who reports the data, how to prevent malicious acts/delays,” and a single reporting error could cause the entire bridge to be wrong.

As for “waiting for confirmation,” many people find it slow, but I think that’s actually one of the few buttons that can save your ass: waiting a few more rounds, waiting for cross-chain messages to truly settle, at least helps avoid some reorganization/rollback/fake finality.
Recently, modularization and the DA layer narrative have been quite popular, developers are talking excitedly, users are confused.
In fact, it’s the same for bridges: the more layers underneath, the more blind spots…
Now I prefer to earn less on cross-chain, avoid bridges if possible, and if I do bridge, I do it in batches with limits—just like that for now.