Gravity Bridge, a native cross-chain protocol born in Cosmos, was the target of a compromised key attack that led to the theft of approximately $5.4 million over the weekend. This latest security breach joins a growing list of exploits that have occurred so far in 2026 in the decentralized finance (DeFi) space.
The gravity bridge hack led to a compromise involving the key: researcher
On Saturday, May 31, blockchain detective Spectre highlighted that the Gravity Bridge could have been used through what he described as a compromise on the signing key. In context, a signing key compromise refers to the unauthorized disclosure or theft of a cryptographic key, allowing an attacker to then exploit it to decrypt sensitive information, forge digital signatures, or gain unauthorized access to systems and, as in this case, funds.
The analyst revealed that the haul included approximately $5.4 million worth of crypto assets, including $4.3 million in USDC, 274 wrapped Ether worth approximately $553,000, $434,000 in USDT, and 14.16 PAXG tokens valued at approximately $64,000. According to security firm PeckShield, the criminal laundered some of the stolen funds through the ChangeNOW and Binance exchanges, but still holds over 2,100 Ether (worth approximately $4.23 million).
The team behind Gravity Bridge confirmed attack on Saturday, saying validators and coordinators should suspend their activities until the exploit is investigated. “Thanks to the quick action of the validators, the bridge is currently detained pending further investigations,” the minutes announced in a subsequent social media post.
Gravity Bridge is a cross-chain protocol that works by locking tokens on the Ethereum network and creating direct replicas of crypto assets on the Cosmos network, relying on validator signatures to authorize each transfer. Therefore, the protocol would treat even forged transactions as legitimate if a bad actor receives the appropriate signing keys.
If this incident is confirmed as a key compromise, the Gravity Bridge incident would be consistent with the current pattern of crypto bridge attacks, where breaches are typically embedded in access control rather than the underlying astute contract code. This pattern can be seen in most recent exploits, with a notable incident being the $292 million Kelp DAO attack.
Crypto hacks will continue to boost in 2026
As mentioned earlier, the $5.4 million Gravity Bridge hack joins the growing list of hacks that rocked the crypto industry, especially the DeFi sector, in 2026. Bridges in particular appear to be supple targets for attackers during this period.
In particular, the TRM Labs report identified April 2026 as the most hacked month, with the highest number of incidents in the history of cryptocurrencies. These attacks included the previously mentioned $292 million Kelp DAO hack and the $285 million loss to Drift Protocol.
Featured image from Shutterstock, chart from TradingView
