Gravity Bridge Loses $5.4M in Suspected Key Compromise

Gravity Bridge lost roughly $5.4 million from its Ethereum-side contract early on May 30 in what on-chain investigators say was likely a compromised signing key. The theft removed $4.3 million in USD Coin, 274 ETH (about $553,000) and about $434,000 in Tether, with an additional $64,000 in PAYG tokens recorded.

The attacker used privileged access to call withdrawal functions on the bridge’s verified Ethereum contract, producing transactions that appeared authorized on-chain. Specter, an on-chain analytics account, flagged two attacker addresses tied to the activity. Security firm PeckShield posted a token breakdown and reported the thief moved part of the proceeds through ChangeNow and Binance to obscure origins. Cyvers Alerts and other monitors confirmed the totals shortly after the drain.

After swapping most of the stolen stablecoins into ether, the attacker now controls about 2,102 ETH, valued at roughly $4.23 million at current prices. The remaining ETH balances and subsequent transactions are visible on public Ethereum explorers, though those funds can be split, mixed or bridged to other chains to further obscure their source.

Gravity Bridge connects Ethereum and the Cosmos ecosystem using the Inter-Blockchain Communication protocol, enabling assets such as USDC to move between chains. The bridge held about $11.5 million in total value locked before the exploit.

Security firms tracking cross-chain incidents noted past breaches that involved compromised keys or validator failures, including attacks on Ronin, Poly Network and the Meter bridge. PeckShield recorded eight major bridge exploits earlier in May that together totaled about $328.6 million.

Recovery options depend on token and infrastructure. Stablecoin issuers can blacklist addresses or freeze tokens in some cases, which can limit movement through custodial platforms. Funds routed through non-custodial swapping services are harder to recover because those platforms do not custody assets.

Gravity Bridge has not issued a public statement. On-chain investigators and security firms continue to monitor the attacker addresses and trace the flow of stolen assets across chains and services.