Gravity Bridge exploit analysis

Gravity Bridge, the cross-chain bridge between Cosmos and Ethereum, lost about $5.4 million on the morning of May 30, 2026. The bridge's own account announced a halt within hours, thanking validators for acting quickly, and the Blockonomi write-up attributed the loss to a compromised validator signing key rather than a flaw in the smart contract code.

What was taken

On-chain analyst Specter identified the suspicious outflow first, with PeckShield confirming the accounting shortly after. The bulk of the loss was $4.3 million in USDC, with smaller amounts in wrapped ether (274 ETH, around $553,000), USDT ($434,000) and 14.16 PAXG ($64,000). Around 2,100 ETH (~$4.23 million) sat in the attacker's primary address for the duration of the reporting window.

Why a key compromise is the working hypothesis

The bridge's smart contracts had been audited and the validator set was permissioned, so the public framing from analysts was that the failure was at the operator level rather than the protocol level. Security researchers noted that no exploit transaction showed malicious proof construction, the pattern that would have indicated a contract bug. The funds were signed out by the bridge's own multisig-style control flow, which is consistent with one of the validator signing keys being used by someone other than the named validator. The official post-mortem was still pending at the time of the Cointelegraph report, and the bridge interface remained unavailable two weeks later.

Where it sits in the corpus

Key compromise has been the dominant bridge failure mode in 2026. The Taiko bridge exploit a few weeks later was also traced to a leaked signing key, this one exposed on GitHub. The Humanity Protocol incident in June used a different vector: malware on an employee laptop holding multisig keys for two chains. Three high-profile losses, three different operator-side failures, and the contracts were not the soft point in any of them.