That detail is the whole game. Everything else is a UX choice on top of the same risk.
The moment it clicked for me was reading a post-mortem after a nine-figure loss. The bridge code had been audited three times. The bug wasn't in the audited code. It was in a permissioned admin key held by a multisig that a few employees could sign, and one of those employees was talked into signing a malicious upgrade. The contract behaved exactly as written; the human boundary around it didn't. Once you see that pattern once, you see it everywhere. The interesting failures at bridges aren't clever math exploits. They're the boring ones: an internal wallet drained, a cloud account compromised, a regulator freezing an address, a team disappearing with the keys. The wrapped token keeps trading on chain as if nothing happened, because nothing on chain has happened. The loss is entirely off-chain, in the legal and operational reality that the on-chain wrap pretends doesn't exist.
So the practical question isn't "which bridge is safest." None of them are safe in the absolute sense. It's: which one keeps my exposure to a third party smallest, and for the shortest window.
Three things I check before using one now.
First, time-in-transit. If the bridge is genuinely locked-and-mint, the wrapped token exists for a few minutes between lock and release, and I'm not exposed to its issuer during that window in the way I would be with a custodial "send" service. The risk shifts to the smart contract, which is a risk I can at least size by reading audits and checking the size of the bug bounty.
Second, the redemption path. I want to be able to go from wrapped on chain B back to native on chain A without asking the bridge team for permission. If unwrap requires a KYC ticket, a manual review, or a withdrawal queue measured in days, I am not the customer; the bridge is my custodian, and I should treat it like one.
Third, the boring stuff. Who is the named legal entity? Where is it incorporated? What does it say about custodianship of the locked assets, in a document a lawyer could read, not in a Medium post? If the answer to any of that is "it's a DAO, bro," I assume my funds are in the hands of whoever currently holds the admin keys, because that is who they are in the hands of.
None of this is a reason to avoid bridges. Cross-chain movement is a real need and the alternatives - centralized exchange accounts in multiple jurisdictions, or just not moving value - have their own frictions and their own counterparty risk. The point is only to pick a bridge the way you'd pick any custodian: small amounts, short windows, and a clear picture of who you trust and for how long.
More on Crypto Bridge.