Movement Native Bridge

The problem

Movement launched with an atomic, HTLC-style bridge that couldn’t give a canonical bridge the liveness or UX it needs. It had to become a lock-mint bridge with attesters without losing the safety the atomic design provided for free, and it held real value from the day it shipped.

What I did

• Took the redesign through governance first, with MIP-58 for the lock/mint model and MD-21 for attesters, then implemented it across Move and Solidity.
• Built the safety model the bridge runs on: inbound rate limiting, counterparty verification, a refund path, access control, and a timelock on privileged actions.
• Added the mint and burn primitives the bridge depends on to Movement’s core Move modules, covered by fuzz and feature-flag testing.
• Own the deployment story end to end: the contract pipeline from MIP-27, a timelock deployment framework, and a genesis that can only succeed once per domain.
• Ran the upgrade of MOVE to a LayerZero OFT on a live token, with real supply and real holders, without downtime or loss.
• Set the security practices the bridge is held to, and review everyone else’s changes to it.
• No bridge deployment under my ownership has ever been exploited.

Stack