AmericanFortress Publishes a Zero-Knowledge Proof That Stops Bridges Paying the Wrong Wallet

Bybit suffered a $1.5 billion loss in February 2025 due to a transaction approving an incorrect transfer destination, according to Chainalysis. In December, a single trader lost $50 million by copying an address from his transaction history that an attacker had planted, reported ScamSniffer. In January, another trader lost $12.25 million through the same method.

These thefts occurred because blockchain transactions send funds to any valid address without verifying its ownership. AmericanFortress has published research introducing a zero-knowledge proof system that allows bridges, exchanges, or recipients to confirm that two wallets on different chains share a common secret without revealing the secret or linking the wallets.

Bridges cannot currently verify if the Solana address belongs to the person who sent Bitcoin, making them vulnerable to attacks. The proposed solution involves the user deriving both Bitcoin and Solana wallets from the same hidden secret. The bridge requests a proof demonstrating that both the Bitcoin address and the Solana address were correctly derived from the shared secret.

The user can then provide one of three types of proofs: a joint proof revealing the relationship only to the verifier, a deferred proof that allows the user to prove the connection at a later time, or a persistent tag that serves as a hash of the hidden anchor, enabling later verification without revealing the connection. The user selects the proof type based on the desired level of disclosure.

The research demonstrates the process using Bitcoin to Solana transfers, showing how the bridge can check the Bitcoin deposit, verify the derivation proofs, and release the funds on Solana only if the proofs are valid.