Recent years have witnessed significant advancements in cross-chain technology. However, the field faces two pressing challenges when it comes to security and privacy. Hacks on cross-chain bridges have led to monetary losses of around 3 billion USD, highlighting flaws in security models governing interoperability mechanisms (IMs) and the ineffectiveness of incident response frameworks. Additionally, the exploration of privacy within cross-chain scenarios remains relatively unexplored. Hackers benefit from extensive privacy, whereas users and bridge operators experience restricted privacy, thereby broadening the potential attack surface for adversaries.

In this paper, we present the most comprehensive study to date on the security and privacy of blockchain interoperability. Our study employs a rigorous systematic literature review, yielding a corpus of 178 relevant documents, including 58 academic papers and 120 gray literature documents, out of a pool of 531. We systematically categorize 56 interoperability solutions based on a newly created taxonomy focusing on security and privacy considerations. Our dataset, comprising academic research, disclosures from bug bounty programs, and audit reports, exposes 45 cross-chain vulnerabilities, 25 theoretical attacks, and 88 mitigation strategies. Leveraging this data, we analyze 14 notable bridge hacks accounting for over USD 2.9 billion in losses, mapping them to the identified vulnerabilities.

Our findings reveal that a substantial portion (65.8\%) of stolen funds originates from projects secured by permissioned intermediary networks with unsecured cryptographic key operations. Regarding privacy, we demonstrate that achieving unlinkability in cross-chain transactions is contingent on the underlying ledgers providing some form of confidentiality.

In conclusion, our study offers critical insights into the challenges and vulnerabilities within the realm of cross-chain interoperability. We pinpoint promising directions for future research that can guide both industry practitioners and academics toward substantial advancements in this field. Our work underscores the urgency of enhancing security and privacy measures in cross-chain technology to mitigate the substantial financial risks associated with bridge hacks and to foster user trust in the blockchain ecosystem.