Gravity Bridge Hack Drains $5.4M, Fits a Four-Year Pattern

Gravity Bridge, the cross-chain protocol that moves tokens between Ethereum and the Cosmos network, lost roughly $5.4 million on May 30 after an attacker drained four assets and forced validators to freeze the system. On-chain researchers traced the breach to a compromised key rather than a smart-contract flaw, the same weakness that has emptied one bridge after another since 2022.

The dollar figure is small next to crypto’s worst exploits. What broke the bridge, though, has broken more than a dozen others the same way over four years, and that is the part worth paying attention to.

A $5.4 Million Drain and a Halted Bridge

The attack surfaced through Specter, an on-chain investigator who first flagged the losses. Four assets left the protocol in a single move, and the breakdown shows how the attacker spread the take across stablecoins and native tokens.

• $4.3 million in Tether (USDT, a US dollar stablecoin)
• 274 ETH worth about $553,000
• $434,000 in Circle’s USD Coin (USDC, another dollar-pegged stablecoin)
• 14.164 PAYG tokens valued near $64,000

The wrongdoer routed part of the haul through ChangeNow, a non-custodial swap service, and Binance, the largest crypto exchange by volume. Even so, most of the value stayed put. Specter pegged the attacker’s remaining holdings at roughly 2,102 ETH, about $4.23 million, sitting across two Ethereum addresses beginning “0x7B5820” and “0x4d3cc32”.

The hit landed on the protocol’s books fast. Gravity Bridge’s total value locked (TVL, the dollar sum of assets a protocol holds) fell from $11.82 million to $6.24 million in a single day, a 47% collapse, according to DeFiLlama’s tracking of the Gravity Bridge protocol balances.

Why a Stolen Key Beats a Smart Contract Bug

Bridges hold real assets on one chain and mint or release matching tokens on another. A set of validators and signing keys authorizes those transfers. Get enough valid keys, and the system stops asking questions.

That is what researchers believe happened here. There was no clever exploit of broken code. The attacker appears to have held the credentials the bridge trusts, so forged withdrawals read as legitimate ones. The protocol’s own coverage of the incident dug into exactly that authorization gap in our report on how a signing-key compromise turned validator trust into the weak point.

Gravity Bridge moved quickly once the drain was spotted. The team posted on X that the situation demanded an immediate stop.

Validators should halt their validators and orchestrators while this incident is being investigated.

Within hours the protocol confirmed the bridge was offline, crediting validators for the speed. A frozen bridge cannot be drained twice, but it also cannot process anyone’s transfers, which is the cost users pay when the trust layer fails.

Bridges Keep Breaking the Same Way

Strip away the dollar amounts and the Gravity Bridge story rhymes with the worst year crypto infrastructure ever had. The 2022 wave of bridge exploits set the template, and key compromise sat at the center of the biggest ones.

Ronin and Harmony fell because attackers got the keys, not because the code was weak. Nomad and Wormhole were code and verification failures, picked apart by anyone who could read the contract. The split matters because the fixes are completely different problems, and a bridge can be airtight on one front while wide open on the other.

Security firm Mandiant traced how the Nomad funds scattered across a “frenzied mob” of copycats in its breakdown of the Nomad bridge exploit, a reminder that once a bridge breaks, the losses rarely stay with one actor. DeFiLlama puts cumulative bridge theft since 2016 near $2.5 billion. Gravity Bridge is simply the newest line on a long list.

Attackers Moved From Code to Keys

The shift that the 2026 hacks confirm is a change in where the soft spot lives. Early bridge thieves hunted for broken math in smart contracts. The current generation goes after the humans and machines that hold the keys.

The data backs the trend. Chainalysis found that private key compromises made up 43.8% of all stolen crypto in 2024, the single largest attack vector, and the firm’s 2026 crypto crime report findings show key-related thefts accounting for the lion’s share of losses when they hit, near 88% of stolen value in one quarter of 2025.

Code audits caught a lot of the old bugs. They do nothing against a phished engineer, a malicious insider, or a North Korean operative embedded inside a team. Gravity Bridge fits that newer mold, where the lock was fine and someone walked off with the key.

2026’s Bridge Bill Keeps Climbing

Gravity Bridge did not happen in a quiet month. It capped a stretch in which cross-chain infrastructure has bled badly, and the totals dwarf the $5.4 million taken from this one protocol.

• $759.84 million stolen across all crypto exploits in 2026 so far, per DeFiLlama
• $328.6 million drained from bridges in May alone, across eight major incidents tracked by security firm PeckShield
• $629.69 million lost in April, the worst single month in crypto history by dollars
• ~$293 million gone from KelpDAO around April 18 through a LayerZero bridge message-spoofing attack

April’s record also included roughly $285 million lifted from Drift Protocol on Solana on April 1, an attack researchers tied to North Korea’s Lazarus Group through social engineering. You can scroll the running tally on the DeFiLlama hacks database, where bridges sit near the top of the loss column year after year.

Bridge TVL keeps growing because users still need to move assets between chains. That growth is exactly why attackers keep coming back. A bigger pot behind the same trust model is a bigger reward for cracking it once.

What Gravity Bridge Users Face Now

For anyone with funds on the protocol, the immediate reality is simple and frustrating. The bridge is halted, transfers are stuck, and there is no public recovery plan yet beyond the investigation validators launched.

The attacker still controls the bulk of the value, more than $4 million in ETH, so the odds of a clean clawback fall as the laundering trail lengthens. Past cases show stolen bridge funds sometimes return through negotiation or law enforcement, and often do not.

If validators bring the bridge back with rotated keys and a fresh audit, the $5.4 million stays a footnote in a brutal year. If the same signing setup comes back online unchanged, the gap that let one key drain four assets is still wide open for the next entry on the list.