Gravity Bridge hack — May 2026

Gravity Bridge, the Cosmos-native bridge that locks assets on Ethereum and mints representations on its own chain, lost about $5.4 million on 29 to 30 May 2026. The team told validators to halt their validators and orchestrators, and the bridge was stopped within hours.

The first reports, from PeckShield and the on-chain analyst Specter, described a suspected compromise of bridge signing keys, and that framing carried into early coverage. Later technical analyses by QuillAudits and Security4Web3 concluded that no key was stolen and no privileged role was needed. The attacker instead poisoned the bridge's denomination-to-ERC20 registry. The Ethereum-side deployERC20() function was permissionless and did not validate the contents of its _cosmosDenom argument. The attacker registered a minimal validator on Gravity chain by self-delegating 80 GRAV, minted worthless tokens through the Osmosis token factory and IBC-transferred them across, then called deployERC20() with fabricated denomination strings embedding the real Ethereum addresses of USDC, USDT, WETH and PAXG. Validators acknowledged the deployments, and the handler wrote the poisoned mapping into the registry without checking whether the target token was already held in custody, a collision check that existed elsewhere in the codebase but was never called at that point. Withdrawal batches 41572 to 41575 then released the genuine custody assets.

PeckShield's breakdown was about $4.3 million in USDC, $434,000 in USDT, 274 ETH worth roughly $553,000 and 14.16 PAXG worth about $64,000. Part of the proceeds moved through ChangeNOW and Binance and some was pushed toward Tornado Cash. Bridge TVL fell from about $11.8 million to $6.2 million within a day.