Gravity Bridge Suffers $5.4 Million Exploit Through Compromised Signing Key

Gravity Bridge, a cross-chain bridge connecting Ethereum and Cosmos, suffered a $5.4 million exploit on May 30, 2026, draining $4.3 million in USDC and 274 ETH from its Ethereum-side contract. Investigators identified a compromised signing key as the attack vector rather than a smart contract flaw. The theft represented nearly all of Gravity Bridge's $6.2 million total value locked, with stolen assets swapped to ETH and moved through ChangeNow and Binance.

Gravity Bridge exploit details

• ▪On-chain analyst Specter identified the suspected attack vector as a compromise of the bridge contract key or signing path
• ▪Gravity Bridge is a cross-chain bridge connecting Ethereum and the Cosmos ecosystem
• ▪The Gravity Bridge theft was flagged on May 30, 2026 by blockchain security firms PeckShieldAlert and Cyvers
• ▪Two Ethereum addresses, 0x7B58…a1F9 and 0x4d3c…7A47, have been linked to the Gravity Bridge theft
• ▪An attacker drained approximately $5.4 million from Gravity Bridge on May 30, 2026
• ▪Gravity Bridge has not published a postmortem or public statement on the May 30, 2026 incident as of the article publication date

Stolen asset breakdown

• ▪The Gravity Bridge attacker drained $4.3 million in USDC from the bridge's Ethereum-side contract
• ▪The Gravity Bridge attacker drained 14,164 PAYG tokens valued at about $64,000 from the bridge's Ethereum-side contract
• ▪The Gravity Bridge attacker drained 274 ETH worth roughly $553,000 from the bridge's Ethereum-side contract

Fund laundering activity

• ▪The Gravity Bridge attacker held roughly 2,102 ETH, approximately $4.23 million, as of May 30, 2026
• ▪A portion of the stolen Gravity Bridge funds had been moved through ChangeNow and Binance as of May 30, 2026
• ▪Cyvers confirmed the stolen Gravity Bridge assets were swapped into native ETH

Bridge vulnerability pattern

• ▪Bridges account for $3.2 billion of the $16.6 billion in total value hacked across crypto history according to DefiLlama data
• ▪The Verus-Ethereum bridge lost $11.5 million on May 18, 2026 after a verification bypass exploit

TVL collapse aftermath

• ▪Gravity Bridge held approximately $6.2 million in total value locked as of May 30, 2026 according to DefiLlama
• ▪Gravity Bridge's total value locked dropped sharply following reports of the May 30, 2026 hack
• ▪The $5.4 million drain represented nearly a big chunk of Gravity Bridge's total value locked