Gravity Bridge loses $5.4 million due to suspected key signing hack

Attackers drained approximately $5.4 million worth of Ethereum-side Gravity Bridge contracts early on May 30. On-chain investigators point to a compromised signing key rather than a flaw in the smart contract.

The exploit removed $4.3 million USD in coins (USDC) and 274 Ethereum (ETH) worth $553,000. PeckShield also registered $434,000 in Tether (USDT) tokens and PAYG worth $64,000.

Inside the gravity bridge breakthrough

The drain came from the bridge’s verified Ethereum contract, with privileged access allowing withdrawals that appeared to be permitted. Analyst Specter reported the incident first, listing two attackers’ addresses linked to the theft.

PeckShield said the hacker transferred a portion of the proceeds through ChangeNow and Binance to hide the assets. Cyvers Alerts and other on-chain monitors confirmed these numbers shortly after.

#PeckShieldAlert the @gravity_bridge Nearly $5.4 million has been depleted, including $4.3 million USD/USD274 $ Ethereum (~$553K), $434K $USDT & 14.164 $PAYG ($64 thousand)

The hacker laundered a portion of the stolen assets through… #ChangeNow & #Binanceand still maintains 2.102K $ Ethereum (~$4.23M). pic.twitter.com/NJSNqc0G78

– Peak Shield Alert (@peakShieldAlert) May 30, 2026

Follow us on XTo get the latest news as it happens

The attacker swapped most of the stablecoins into ETH and now controls about 2,102 ETH worth about $4.23 million.

Bridges remain the weakest link in cryptocurrencies

Gravity Bridge connects Ethereum and… Global Ecosystem through IBCallowing assets such as USDC to move between chains. The bridge had approximately $11.5 million in total value closed prior to drainage.

past Cross-chain bridge attacks Like Ronin and Poly Network revealed how the focused switches became a coil Single point of failure.

PeckShield previously recorded eight major bridge breaches totaling $328.6 million in May alone.

Includes previous incidents Penetrating the meter bridge and a broader pattern of verification key failures across the sector.

Stablecoin issuers can blacklist addresses in minutes. Funds routed through non-custodial services like ChangeNow are difficult to recover.

The entire remaining ETH cache can be tracked on Etherscan but can still be split, mixed, or linked to other chains.

The Gravity Bridge team has not issued a public response.

this post Gravity Bridge loses $5.4 million due to suspected key signing hack appeared first on BeInCrypto.

Source link