color: var(color-red-500)

by

Gravity Bridge Hit in $5.4M Exploit Amid Suspected Key Compromise

Show AI Summary
Attackers exploited a suspected key compromise in Gravity Bridge’s authorization system, draining millions in cryptocurrency.
Stolen assets were transferred through centralized platforms like ChangeNow and Binance, with attackers retaining millions in Ethereum.
Researchers linked two Ethereum addresses to the attack, indicating a potential breach in the bridge’s signing or authorization process.

Gravity Bridge, which connects Ethereum and the Cosmos network, appears to have been hacked, resulting in a loss of around $5.4 million. Security experts noticed large and unexpected withdrawals of various cryptocurrencies – including USDC, ETH, USDT, and PAYG – suggesting someone may have gained unauthorized access to the system.

Tracking the stolen funds on the blockchain shows the attacker used services like ChangeNow and Binance to move some of the money, but still held onto millions worth of Ethereum. This suggests the attacker may have compromised the security system that controls access to the bridge.

Security researchers at PeckShield have detected a major theft from the Gravity Bridge, totaling approximately $5.4 million. This includes $4.3 million in USDC, 274 ETH (worth around $553,000), $434,000 in USDT, and $64,000 in PAYG. The hacker has already moved some of the stolen funds through cryptocurrency exchange services ChangeNow and Binance, but still holds onto 2.102 ETH (valued at approximately $4.23 million).

— PeckShieldAlert (@PeckShieldAlert) May 30, 2026

Initial reports indicate the stolen funds totaled approximately $4.3 million in USDC, $553,000 in ETH (274 coins), $434,000 in USDT, and $64,000 in PAYG. Investigators have also identified two Ethereum addresses – 0x7B..a1F9 and 0x4d..7A47 – connected to the attack. While Gravity Bridge hasn’t yet published a complete analysis of what happened, current information points to a problem with the system’s signing or authorization processes, rather than a simple hack of an individual user account.

Key compromise suspected in bridge attack

As a researcher investigating this incident, my analysis, along with that of security analyst Specter, suggests the attacker probably got in by either compromising a key used for a bridge contract or by hijacking a signing process. What’s particularly concerning is how quickly the attacker acted – they started transferring funds immediately after exploiting the vulnerability. Based on our findings, the attacker specifically targeted and drained major stablecoins and ETH during the breach.

Experts believe the hacker still has over $4 million in Ethereum even after attempting to hide some of the stolen funds. This indicates the attack likely didn’t exploit a direct flaw in the smart contract’s code, but instead used legitimate-looking authorizations. Investigators now think the problem was a security breach affecting who was allowed to approve transactions, or with the systems verifying those approvals, rather than a mistake in the code itself.

The Gravity Bridge appears to have been hacked, and approximately $5.4 million in cryptocurrency was stolen. The attacker took the following:

* $4.3 million in USDC
* 274 ETH (worth about $553,000)
* $434,000 in USDT
* $64,000 in PAYG

The funds were sent to this address: 0x7B582033061b96cC3F9421e73a749ED7C62da1F9…

— Specter (@SpecterAnalyst) May 30, 2026

As a researcher, I’ve been studying Gravity Bridge, which connects Ethereum and Cosmos. Essentially, it works by locking up Ethereum tokens on the Ethereum network and creating equivalent ‘mirror’ tokens on Cosmos chains. The bridge relies on validator signatures to confirm transactions. This creates a vulnerability: if someone gains access to those validator signing keys, they could potentially initiate fraudulent withdrawals.

Cross-chain bridge security under pressure

This year has seen several security breaches in the systems that connect different blockchains, with various projects losing funds due to stolen private keys and problems with how messages are checked. Gravity Bridge is the latest in a string of affected projects, as these kinds of attacks keep happening across the world of decentralized finance.

Recent hacks have raised worries about weaknesses in the systems that connect different blockchains. For example, earlier this month, Stake DAO announced a security issue where new tokens were created without permission on the Arbitrum network, though they confirmed the main part of their platform and its funds were still safe.

MAP Protocol and ButterNetwork recently experienced a bridge attack where hackers created almost one quadrillion MAPO tokens. Security firm Blockaid explained that the attack happened because of weaknesses in how the bridge verified information. Hackers were able to change transaction data to bypass security measures and create the tokens without permission.

These incidents are part of a growing trend of attacks targeting bridges in the cryptocurrency world. By May 18, 2026, security firm PeckShield had identified at least eight major hacks of these bridges, with total estimated losses around $328.6 million.

Read More

2026-05-30 13:41