Gravity Bridge loses $5.4 million in suspected key breach

The Gravity Bridge, a cross-chain protocol connecting the Ethereum and Cosmos ecosystems, was drained of approximately $5.4 million in a suspected security breach early on May 30. Security researchers believe the incident stemmed from a compromise of the bridge's authorization keys rather than a flaw in its smart contract code.

The unusual outflows were first flagged by on-chain analyst Specter and later corroborated by security firm PeckShield. According to their assessments, the attacker gained control of enough valid signing keys to make unauthorized withdrawals appear legitimate to the bridge's system. The stolen assets included about $4.3 million in USDC, 274 wrapped ether valued at roughly $553,000, $434,000 in USDT, and 14.16 PAXG tokens worth approximately $64,000.

The Gravity team confirmed an incident on social media platform X and asked validators and orchestrators to halt their operations while the investigation continues. The bridge itself has been halted. The team has not yet released a detailed postmortem, leaving the exact entry point for the attack unconfirmed.

Investigators are tracking the stolen funds. PeckShield reported that a portion of the haul has already...