Gravity Bridge Halted After $5.4M Drain; Signing-Layer Compromise Suspected

Gravity Bridge halted its Ethereum-Cosmos bridge after a reported $5.4 million drain discovered early Saturday, a loss that appears to account for most of the protocol’s value locked.

Early security analysis cited by The Block and Crypto.News suggested the incident looked more like a compromise of the bridge’s signing or authorization layer than a direct exploit of its smart-contract code. That distinction matters because a key or authorization breach can allow attackers to approve withdrawals without breaking the underlying contract logic. Gravity Bridge had not officially confirmed the root cause as of Sunday and had not released a full post-mortem.

The reported losses, based on on-chain monitoring and security researchers including PeckShield and analyst Specter, included about $4.3 million in USDC, 274 wrapped ether worth roughly $553,000 at the time of reporting, $434,000 in USDT and 14.164 PAXG worth about $64,000. As it investigated, Gravity Bridge told participants running the network to stop operations. “There was an unfortunate incident on Gravity. Validators should halt their validators and orchestrators while this incident is being investigated,” the project said in a statement reproduced by The Block and Crypto.News.

The scale of the drain was significant relative to the bridge’s size. DeFiLlama, which tracks assets held in decentralized finance protocols, showed Gravity Bridge with total value locked of roughly $6.26 million to $6.29 million around the time of the incident. That means the reported loss represented a very large share of the bridge’s assets, and likely most of the funds entrusted to it.

Gravity Bridge is a Cosmos-based cross-chain bridge designed to move Ethereum-based ERC-20 tokens between the Ethereum and Cosmos ecosystems. In broad terms, users lock assets on Ethereum and receive mirrored versions on the Cosmos side. To make that work, the system depends on validators and off-chain orchestrators to sign and relay cross-chain transfers. If that signing or authorization layer is compromised, an attacker may be able to trigger withdrawals or releases of funds even if the smart contracts themselves are functioning as written.

That operational model helps explain why early analysts focused on keys and authorization rather than contract logic. A smart-contract bug usually points to faulty code onchain. A signing-layer compromise, by contrast, suggests the bridge may have processed transactions that appeared valid because the required approvals were obtained or forged through compromised credentials.

The incident also lands amid continued pressure on cross-chain infrastructure. PeckShield has said at least eight major cross-chain bridge attacks drained about $328.6 million between February and mid-May 2026.

For now, however, the precise technical entry point in the Gravity Bridge incident remains unconfirmed. The bridge was halted, validators and orchestrators were told to stop, and no full post-mortem had been published by the time of reporting.