Gravity Bridge Halted After Reported $5.4M Exploit

Gravity Bridge, a cross-chain protocol connecting Ethereum and Cosmos, was reported exploited on 2026-05-31, with losses put at roughly $5.4 million.^[1] The incident was described publicly as a drain of bridge-controlled assets rather than a market dislocation or accounting shortfall, and the immediate working hypothesis in reporting was that a bridge contract or signing key had been compromised.^[2] As documented in the available record, the event therefore fit a familiar bridge-failure pattern in which control over a privileged operational component appears to have been sufficient to authorize or facilitate unauthorized outflows, although the exact mechanism has not been established in the present dossier.^[2]

The earliest pivotal public signal was the observation of unusual outflows. Reporting cited on-chain analyst Specter, who flagged those movements and said the bridge contract key may have been compromised.^[2] That attribution matters because the available record did not describe an exploit of a user-facing interface or a disclosed flaw in ordinary transaction validation; instead, the reported theory centered on compromise of a privileged control point associated with bridge operations.^[2] In practical terms, the incident was therefore framed from the outset as a possible key-compromise event affecting the bridge’s authority structure rather than a conventional wallet phishing case or a publicly documented smart-contract logic bug.^[2]

Publicly cited asset tracing then supplied the composition of the losses. PeckShield reported that the stolen assets included about $4.3 million in USDC, 274 WETH, roughly $434,000 in USDT, and 14.164 PAXG.^[3] The on-chain data in the brief also associated the incident with Ethereum and listed those same categories of assets as the principal components of the drain.^[3] The distribution indicated that the loss was concentrated in liquid bridge-held reserves rather than in a single volatile token, which is consistent with an unauthorized withdrawal from infrastructure that custodied multiple transferred assets.^[3] The record did not provide a transaction-by-transaction reconstruction, but it did establish that the reported loss amount was derived from these identified token balances and their contemporaneous valuations.^[1][3]

After the outflows were identified, the response was operational rather than forensic in the public record. The Gravity Bridge team instructed validators to halt their validators and orchestrators while the incident was investigated.^[4] Gravity Bridge later confirmed that it had been halted.^[5] This sequence indicated that the maintainers treated continued bridge operation as a live risk and sought to stop further state transitions or relaying activity pending review.^[4][5] Because Gravity Bridge depended on validator and orchestrator participation, the instruction to stop those components functioned as an emergency containment measure directed at the bridge’s control plane rather than at end users alone.^[4]

The public record also suggested that at least part of the proceeds moved quickly after the drain. PeckShield reported that some of the stolen funds had already been laundered through ChangeNow and Binance.^[6] That claim, as presented in the reporting, did not specify amounts routed through each venue, the exact sequence of transfers, or whether any assets were frozen or recovered.^[6] It nevertheless indicated that the post-exploit phase began immediately and that at least a portion of the assets had entered services commonly referenced in tracing narratives involving swaps or exchange deposits.^[6] As of the present record, this remains an attributed tracing claim rather than a fully documented recovery or enforcement outcome.^[6]

The documented consequences were therefore threefold. First, the reported direct loss was roughly $5.4 million, composed mainly of USDC with additional WETH, USDT and PAXG.^[1][3] Second, bridge operations were halted, with validators and orchestrators instructed to stop while the incident was investigated, indicating a material interruption to protocol function.^[4][5] Third, public reporting associated part of the stolen funds with laundering activity through ChangeNow and Binance, but the dossier did not identify any court proceeding, formal charge, recovery percentage, or final legal disposition.^[6]