Bridges between separate blockchains have, at least briefly, custody of the asset. Most bridges work by transferring the asset to the bridge, with instructions to transfer it onward to some other wallet. Which is why bridges can steal the asset while in transit. This happens. A lot, to the tune of about US$3 billion so far.

The paper gets rather hand-wavey when discussing inter-blockchain bridges and trust. But they don't have a solution. They wrote:

"Having already implicitly addressed generalizability (the ability to process arbitrary data) and extensibility (the support of and effort required to expand an interoperability system with new chains), trustlessness undeniably represents the most important dimension, practically speaking, given the number of hacks and amount of damage already suffered by the space.g,4,10 Trustlessness—a measure for the additional trust required from users of an interoperability system beyond that in the underlying source and destination chains—is closely related to the solution’s verification mechanism, potential further trust, and liveness assumptions; and together with these, it constitutes protocol-sided security. However, given the difficulty of reliably assessing highly complex systems with unique architectures, constantly changing maturity, and under permanent threat from a variety of risks and attack vectors, a new approach to trust in interoperability is to look at it as a spectrum."

"Look at it as a spectrum" means "we don't know how to fix this."

There are lots of schemes to fix this.[1] They're really complicated (hence vulnerable), slow, or not really trustless. It's a hard problem. Throwing buzzwords at it does not help.

[1] https://medium.com/connext/the-interoperability-trilemma-657...