Gravity Bridge Suffers $5.4 Million Exploit Through Compromised Signing Key

May 30, 2026

Gravity Bridge, a cross-chain bridge connecting Ethereum and Cosmos, suffered a $5.4 million exploit on May 30, 2026, draining $4.3 million in USDC and 274 ETH from its Ethereum-side contract. Investigators identified a compromised signing key as the attack vector rather than a smart contract flaw. The theft represented nearly all of Gravity Bridge's $6.2 million total value locked, with stolen assets swapped to ETH and moved through ChangeNow and Binance.

Gravity Bridge exploit details

▪On-chain analyst Specter identified the suspected attack vector as a compromise of the bridge contract key or signing path.
▪Gravity Bridge is a cross-chain bridge connecting Ethereum and the Cosmos ecosystem.
▪The Gravity Bridge theft was flagged on May 30, 2026 by blockchain security firms PeckShieldAlert and Cyvers.
▪Two Ethereum addresses, 0x7B58…a1F9 and 0x4d3c…7A47, have been linked to the Gravity Bridge theft.
▪An attacker drained approximately $5.4 million from Gravity Bridge on May 30, 2026.
▪Gravity Bridge has not published a postmortem or public statement on the May 30, 2026 incident as of the article publication date.

Stolen asset breakdown

▪The Gravity Bridge attacker drained $4.3 million in USDC from the bridge's Ethereum-side contract.
▪The Gravity Bridge attacker drained 14,164 PAYG tokens valued at about $64,000 from the bridge's Ethereum-side contract.
▪The Gravity Bridge attacker drained 274 ETH worth roughly $553,000 from the bridge's Ethereum-side contract.

Fund laundering activity

▪The Gravity Bridge attacker held roughly 2,102 ETH, approximately $4.23 million, as of May 30, 2026.
▪A portion of the stolen Gravity Bridge funds had been moved through ChangeNow and Binance as of May 30, 2026.
▪Cyvers confirmed the stolen Gravity Bridge assets were swapped into native ETH.

Bridge vulnerability pattern

▪Bridges account for $3.2 billion of the $16.6 billion in total value hacked across crypto history according to DefiLlama data.
▪The Verus-Ethereum bridge lost $11.5 million on May 18, 2026 after a verification bypass exploit.

TVL collapse aftermath

▪Gravity Bridge held approximately $6.2 million in total value locked as of May 30, 2026 according to DefiLlama.
▪Gravity Bridge's total value locked dropped sharply following reports of the May 30, 2026 hack.
▪The $5.4 million drain represented nearly a big chunk of Gravity Bridge's total value locked.