Cross-chain bridges play a vital role in enabling asset and data transfer across multiple blockchains, yet they have become prime targets for attacks due to inherent code vulnerabilities. Thus, it is of great significance to define and analyse the defects in cross-chain bridges. In this paper, we investigate 44 attacks on cross-chain bridges in the real world, and categorize them into four types of defects: incorrect cross-chain business logic, missing checks for important fields, unrealized fallback logic, and insecure call permission. Moreover, corresponding defensive measures are provided for the above defects. To further explore the transaction patterns resulting from these defects, we model cross-chain transactions as a transaction execution heterogeneous graph and apply graph mining techniques to identify key metapaths essential for attack detection. This study contributes to a deeper understanding of current security risks in cross-chain bridges and lays the foundation for building a more secure cross-chain ecosystem.