Cross-chain bridges secure billions in transferred digital assets but suffer frequent exploits. Current detection systems rely heavily on manual rules or protocol-specific graph features, leading to high false-negative rates when applied to unseen bridge architectures under distribution shift. We formulate ProtoGuard to detect attacks across previously unseen bridges without target-domain retraining. The model maps raw execution traces into protocol-agnostic execution graphs, capturing role embeddings, relative vault balance volatility, and execution depth. We combine a temporal relational graph neural network with invariant risk minimisation and supervised contrastive loss to align malicious execution representations across disparate bridge designs. Evaluated across 12 bridge protocols comprising 120,049 graphs under a leave-one-bridge-out setup, ProtoGuard obtains a 92.78\% F1-score, 90.00\% recall, and 0.21% false-positive rate on held-out protocols, outperforming domain-adversarial and graph baselines by 7.58\% to 34.88\% in $F_1$-score. These results indicate that protocol-invariant modelling offers a viable, general security layer for heterogeneous bridge ecosystems.

Cross-Chain Bridge Security,Domain Generalization,Invariant Risk Minimization,Graph Neural Networks,Intrusion Detection