I read the DYORSWAP compensation notice four times, and the thing that stopped me wasn't the 40% haircut. It was the absence of a hash.
No audit link. No address for a reserve wallet. No block number for the event. No root-cause write-up. A cross-chain bridge exists for one purpose — holding other people's capital while it moves between chains — and this one published a document about losing that capital without ever explaining how the lock broke. I didn't need a chart to form a view. I needed one line a stranger could verify independently. The notice contains none.
The only hard number in the entire document is 40%. Everything else is tone.
Let me be precise about what is actually public. DYORSWAP is a bridge I have never routed through, never seen occupying a leg of any aggregator path I check, and never seen referenced by a protocol I integrate with. What exists is a single notice, structured as ten short bullet points. Affected addresses have been reviewed. Addresses holding less than 5 ETH receive a flat 40% of their computed loss. Addresses above 5 ETH are reviewed individually. A portion of the total loss is attributed to "phishing and fraudulent cross-chain activity." Official contact channels are listed. The notice repeats, three separate times, that nobody should transfer funds, sign approvals, or pay fees to claim. And the final line says more details will be released in stages.
That is the whole disclosure. No architecture. No supported chains. No attestation. No entity name. No jurisdiction. No timeline.
If you have been in this market through a full cycle, you already recognize the shape. Wormhole, February 2022, $326 million. Ronin, March 2022, $625 million. Nomad, August 2022, $190 million. Each of those produced a public post-mortem within days — signed by a named firm, attached to concrete transaction hashes, followed by a fork, a raise, or a bailout with a number attached. The reason wasn't virtue. It was that bridges live or die on a binary asset. Trust doesn't decay along a curve in this sector; it flips. Once a bridge is understood to have lost user funds without explanation, the routing tables stop pointing at it, and they never point back.
So the interesting question here is not what DYORSWAP lost. It's what the structure of this notice tells us about what DYORSWAP is.
A protocol that can unilaterally announce a haircut is not a trust-minimized protocol. Bridges come in roughly three shapes. Light-client verification, where the destination chain validates source-chain state directly — expensive, slow, and structurally difficult to compromise. Optimistic designs with an external validator set and a fraud window. And lock-and-mint, where a multisig or an MPC committee holds the keys to the vault. You can only publish "we will pay 40%" if someone, somewhere, holds a key that can move treasury funds. That sentence cannot be written by a contract with no admin path. So either this is the third shape, or there's a privileged upgrade route nobody has disclosed. I don't need to guess which. The notice itself is the evidence.
The 5 ETH threshold is a user-distribution disclosure in disguise. Reading a population from the cutoffs in its compensation schedule is an old forensic trick, and it works. A flat retail band that stops at 5 ETH tells you the median affected address was small. A bridge serving meaningful institutional or treasury flow would never draw its line there — the tail above that number would be most of the value and the flat band would be noise. Here the band is the policy and the tail is the exception. That is the profile of a long-tail bridge with a retail-heavy depositor base, which is also the exact profile that has the least capacity to make anyone whole.
"Phishing and fraudulent cross-chain activity" is a liability-management phrase, not a finding. Contract exploits and end-user wallet compromises are different events with different evidentiary trails. If funds left the bridge's own contracts, there's an attacker address, a transaction, and a post-mortem, because that's the minimum professional standard. If users signed malicious approvals elsewhere, you publish the drainer addresses so people can check their own history. The notice provides neither. Either the team doesn't know what happened, or it knows and prefers the ambiguity. Either way, the language moves the loss from their column into yours.
40% is not generosity. It is a balance sheet statement. This is the part I keep returning to. Forty percent is the number you publish when one hundred percent is not on the table, and it is almost always a negotiated figure rather than an actuarial one. In November 2022 I spent forty-eight hours pulling apart reserve attestations while the market argued about whether the largest stablecoin would break. The lesson from that week never left me: a reserve claim is worth exactly as much as the addresses attached to it. Reconcilable addresses count. PDFs count for nothing. I didn't find an address in this notice.
Front-running isn't the risk here. The refund is. Preemptive language telling users they will never be asked to transfer, sign, or pay is an admission of the attack surface. Anyone who has watched a mempool during an exploit knows the pattern: the announcement is the alpha, and the attacker reads the same announcement you do, four hours earlier. There is a pool of claimants who have been told money is coming, a claiming process that hasn't been specified, and a stated intention to release details gradually. That is a target, not a plan.
The generous reading of this notice is that 40% beats zero and the team is at least trying. That reading is hopium with a spreadsheet stapled to it.
Compensation announcements are a marketing instrument. The uncovered 60% does not vanish — it converts into a legal claim that most holders will never pursue, against an entity whose name has not been published. The bridges that recovered did so because they had a balance sheet, a venture network, and a chain that mattered to enough people that letting it die was the more expensive option. A long-tail bridge with anonymous operators, no disclosed jurisdiction, and no visible backers has none of those levers. The blockchain doesn't care about intent. It records what you signed and nothing else.
The tiered review is a bigger problem than the haircut. Below 5 ETH you get an algorithmic number and a rule you can check. Above 5 ETH you get a discretionary process with undisclosed criteria, an undisclosed timeline, no visible appeals path, and a category — fraud — that some claimants have apparently already been sorted into. That is an inverted burden of proof: the large holder must establish innocence to a reviewer whose standards are secret. In any post-mortem I've been part of, that structure produces two outcomes, selective payment and quiet resentment, and both of them outlive the incident.
Six months from now, the number that matters won't be 40%. It will be whether a single reconcilable reserve address ever appeared, and whether an independent firm ever signed a root-cause report. Those two artifacts separate a restructure from a wind-down. Here is the clock I'm running, and you can run it too.
Four weeks. If no reserve addresses, no third-party findings, and no published claim contract exist by then, treat the 40% as worth zero in your own accounting and stop planning around it. Move it to a contingent-asset column and leave it there.
If you are above the 5 ETH line, submit your evidence now, on the record, referencing exact transaction hashes and dates, and keep your own copy. Do not wait for the review process to tell you what it wants. Anything that reads as a demand for a signature, a seed phrase, or a gas payment to release a refund is a drainer, without exception. A refund is an outbound transaction from them to you. There is no configuration of a legitimate refund that requires you to approve anything first.
And watch the next two weeks for cloned claim pages. This notice is a script, and someone has already read it.
The name on the front of this project is a warning label people forgot how to read. Do your own research is the advice, and the document itself is the case study.