{"id":"gravity-bridge-crypto-theft-may-2026","category":"breach","status":"closed","title":"Gravity Bridge loses about US$5.4 million; restart and user recovery remain unconfirmed","tldr":"Gravity Bridge lost about US$5.4 million and halted transfers between Ethereum and Cosmos. Later research disputes the initial stolen-key theory. Recovery and a safe restart remain unconfirmed; avoid new deposits and check any exposure with your custodian.","summary":"Gravity Bridge, a service connecting Ethereum and Cosmos, lost approximately US$5.4 million in unauthorised withdrawals reported on 30 May. The stolen assets included USDC, wrapped ether, USDT and PAXG tokenised gold. The incident concerns people holding assets through the bridge. Gravity acknowledged the incident and halted operations. Initial reports suspected compromised signing keys, but QuillAudits’ 3 June analysis instead identified corrupted token-registration records that caused real assets to be released against worthless tokens. QuillAudits said part of the sequence still needed an official postmortem. Some funds passed through ChangeNow and Binance, according to PeckShield; subsequent research reported laundering through Tornado Cash. The latest dated operational report read, published by Rekt on 4 June, said the bridge remained offline without a restart timetable or compensation plan. Checks through 3 November found no later confirmation of a released fix, safe restart, recovered funds, user reimbursement or criminal charges.","action":"Avoid new Gravity Bridge deposits until the team confirms a safe restart. If you hold assets through it, ask your wallet provider or custodian to identify your exposure and verify any recovery instructions through established official channels.","product":"Gravity Bridge Ethereum–Cosmos crypto bridge","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["gravity-bridge","crypto","ethereum","cosmos","crypto-theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"post","title":"Gravity Bridge incident halt statement (read as reproduced in reports; direct X access blocked)","url":"https://x.com/gravity_bridge/status/2060715098809970741","by":"Gravity Bridge","date":"2026-05-30"},{"kind":"news","title":"Cosmos-based Gravity Bridge drained of $5.4 million in suspected key compromise, researchers say","url":"https://www.theblock.co/news/ecosystems/2026-05-30-cosmos-based-gravity-bridge-drained-of-5-4-million-in-suspected-key-compromise-researchers-say-403108","by":"The Block","date":"2026-05-30"},{"kind":"news","title":"Gravity Bridge halted after $5.4M drain hits Ethereum-Cosmos link","url":"https://crypto.news/gravity-bridge-halted-after-5-4m-drain-hits-ethereum-cosmos-link/","by":"crypto.news","date":"2026-05-30"},{"kind":"research","title":"Gravity Bridge $5.4M Denom Mapping Exploit (Explained)","url":"https://www.quillaudits.com/blog/hack-analysis/gravity-bridge-demon-mapping-poisoning","by":"QuillAudits","date":"2026-06-03"},{"kind":"news","title":"Gravity Bridge - Rekt","url":"https://rekt.news/gravity-bridge-rekt","by":"Rekt","date":"2026-06-04"}],"started":"2026-05-30","closed":"2026-06-04","created":"2026-11-03T21:49:05.250Z","updated":"2026-11-03T21:49:05.250Z","cve_notes":[],"timeline":[{"at":"2026-06-04","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Rekt reported that the bridge remained offline, with no restart timetable, compensation plan or official postmortem published. Its account also attributed the theft to corrupted token records rather than stolen signing keys.","url":"https://rekt.news/gravity-bridge-rekt","by":"Rekt","patch":null},{"at":"2026-06-03","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"QuillAudits attributed the theft to corrupted token-registration records rather than compromised keys. It said most funds remained in an attacker-controlled wallet, with laundering through Tornado Cash underway; part of the technical sequence still required an official postmortem.","url":"https://www.quillaudits.com/blog/hack-analysis/gravity-bridge-demon-mapping-poisoning","by":"QuillAudits","patch":null},{"at":"2026-05-30","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Gravity Bridge acknowledged the incident, instructed validators and orchestrators to stop, and subsequently confirmed that the bridge was halted while it investigated. PeckShield reported that some stolen funds had passed through ChangeNow and Binance.","url":"https://crypto.news/gravity-bridge-halted-after-5-4m-drain-hits-ethereum-cosmos-link/","by":"crypto.news","patch":null},{"at":"2026-05-30","added":"2026-11-03T21:45:10.669Z","kind":"disclosed","text":"Researchers reported approximately US$5.4 million stolen from Gravity Bridge: US$4.3 million in USDC, 274 wrapped ether, US$434,000 in USDT and 14.16 PAXG gold tokens. Early assessments suspected compromised signing keys.","url":"https://www.theblock.co/news/ecosystems/2026-05-30-cosmos-based-gravity-bridge-drained-of-5-4-million-in-suspected-key-compromise-researchers-say-403108","by":"The Block","patch":"na"}],"url":"https://hard.fyi/live/gravity-bridge-crypto-theft-may-2026/","json":"https://hard.fyi/api/live?id=gravity-bridge-crypto-theft-may-2026"}