Gravity Bridge, a cross-chain bridge connecting the Ethereum and Cosmos ecosystem, experienced an unusual outflow of funds, resulting in a loss of approximately $5.4 million. The project team subsequently suspended bridging services and requested validators and orchestrators to cease related operations pending further investigation.
Details of assets transferred out
On-chain analyst Specter was the first to disclose the unusual withdrawals, suggesting the transaction patterns were more likely due to an bypassed authorization layer or compromised signing keys, rather than a vulnerability in the smart contract code itself. Security firm PeckShield subsequently offered a similar assessment.
PeckShield stated that the transferred assets included approximately $4.3 million in USDC, 274 wrapped Ethereum tokens worth approximately $553,000, approximately $434,000 in USDT, and 14.16 PAXG tokens worth approximately $64,000.
- USDC approximately 4.3 million
- 274 WETH, approximately $553,000
- USDT and PAXG total approximately $498,000.
Signature keys become the focus of the investigation
The Gravity Bridge works by first locking assets on the Ethereum side and then minting mapped tokens on the Cosmos side. Cross-chain asset transfers require validator signature authorization.
Specter argues that if an attacker possesses enough valid signing keys, they can make withdrawals appear legitimate within the system. This explains why current indications suggest authorization abuse rather than a direct breach of the contract logic.
After confirming the security incident on X, the project team first requested validators to suspend nodes and orchestrators, and then stated that the cross-chain bridge had completely stopped operating. The team has not yet released a full recap, and the specific entry point remains unconfirmed.
Some funds flowed to trading services
PeckShield stated that some of the stolen funds flowed through ChangeNow and Binance after the incident. At the time of the update, the wallet in question still held approximately 2,100 ETH, worth about $4.23 million at the time.
Gravity Bridge was developed with the participation of contributors including the Althea team, and the protocol is secured by the GRAV token. To date, the project team has not specified whether the problem lies with the validator infrastructure, private key management, or other operational aspects.
If this incident is ultimately confirmed to be related to a key management error, it will once again highlight the risks associated with the authorization layer of cross-chain bridges. Since 2026, researchers have pointed to key and operational aspects, rather than the audited contract code, as the cause of multiple bridging or protocol security incidents.
