Polygon’s AggLayer: five myths about chain abstraction

The failure of multisig bridges

A single forged signature on the KelpDAO LayerZero bridge drained $292 million in rsETH. The attacker used the stolen assets as collateral to borrow ETH on Aave, which left up to $230 million in bad debt. This event triggered a $6.6 billion run on Aave as users exited the protocol within 24 hours. Lido, SparkLend, Fluid, Upshift, and Ethena all paused relevant markets or bridges because of the exploit. Most cross-chain infrastructure relies on off-chain committees or multisigs to attest to state changes. For instance, 47% of LayerZero applications use a 1-of-1 verifier configuration, while 45% use 2-2. This concentration of power makes the industry vulnerable to a single compromised signer. In August 2026, an attacker drained 191,156 USDC from Allbridge’s CCTP router on Base by redeeming a forged message that sat unused for 24 days. Earlier that same month, a different attacker took $1.65 million from Allbridge’s Solana pools. Polygon processed $200 million in bridge volume for chains like Katana during the KelpDAO incident. Agglayer avoids these vulnerabilities because it uses zero-knowledge proofs instead of operator committees.

Agglayer math and security

Agglayer replaces human signers with mathematical proofs. The architecture uses ZK proofs and pessimistic proofs, powered by Succinct’s SP1 and Polygon Plonky3, to enforce security at production scale. These pessimistic proofs function as a bridge accountant that verifies every transaction against the ledger to ensure no chain withdraws more assets than the system records. If an attacker submits a withdrawal for 116,500 rsETH without a matching deposit, the pessimistic proof fails and the withdrawal remains blocked. This design prevents the infinite-mint category of attacks that compromised the Sandbox bridge and the Coreum-XRPL bridge. You already know that math provides more certainty than a quorum of operators meeting at 3am on a weekend. The system uses a massive Sparkle Merkle Tree to manage Local Exit Roots, Rollup Exit Roots, Mainnet Exit Roots, and Global Exit Roots. Proving costs fell 45x in one year, which moved ZK technology from research labs into production infrastructure. In July 2025, the Ethereum Foundation set real-time proving targets of under 10 seconds for 99 percent of mainnet blocks using a $100,000 rig.

The Unified Bridge and interoperability

The Unified Bridge, formerly the LxLy bridge, manages asset transfers and cross-chain execution for all connected chains. It uses on-chain contracts and off-chain services, including chain indexer frameworks and proof generation APIs, to facilitate movement. A smart contract on Ethereum is a common point for transferring native assets across the Agglayer. The data structure includes a Local Exit Root, a Rollup Exit Root, a Mainnet Exit Root, and a Global Exit Root. Agglayer connects diverse chains through a single interface. This setup gives access to unified liquidity and reduces fragmentation.

The bridgeAndCall() feature allows developers to initiate calls on a destination chain directly from a source chain. The system uses a Global Exit Root, which is the hash of the rollupExitRoot and mainnetExitRoot. This structure allows the L2 sequencer to fetch the latest global exit root. When a user bridges assets from Layer 1 to Layer 2, the bridge contract on Layer 1 appends an exit leaf to the exit tree and updates the exit root. The global exit root manager on Layer 1 then appends the updated root to the global exit tree. The L2 sequencer fetches the latest global exit root, and the user initiates a claim on Layer 2 by providing an SMT proof. The L2 bridge contract validates the SMT proof and transfers the asset on the destination chain. Union recently announced intentions to integrate with Agglayer, which will enable near-seamless message passing between Cosmos-based chains and the broader network. This integration connects Celestia’s ecosystem to the Agglayer by using a modular stack.

Deployment and institutional use

Institutions deploying on Polygon CDK receive Agglayer connectivity as a default feature of their initial deployment. This eliminates the need for separate bridge integration projects or additional vendor negotiations. Katana, a chain built on Polygon CDK, maintained liquidity and zero exposure throughout the KelpDAO incident because of its ZK architecture. However, current production deployments for Agglayer CDK typically run closer to one second for block times. The system aims to reduce cross-chain settlement to under ten seconds by early 2026. Ronin targets block times between 100 and 250ms and requires full sovereignty and sequencer ownership. The migration to an L2 would allow Ronin to inherit Ethereum’s security and liquidity. Will the industry move away from trusted attestations entirely?