Breaches and incidentsBriefConfirmed by two or more outlets
Gravity Bridge (Ethereum-Cosmos): about USD 5.4M drained
Drain 29 May 2026, first statement 30 May: about 4.35M USDC, 434K USDT, 274 WETH and 14.16 PAXG (about USD 5.4M) from Ethereum custody.
- Disclosed
What happened
- Root cause: disputed and no post-mortem published. Early alerts suggested a key or signing-path compromise. Rekt and QuillAudits describe denom-mapping poisoning: a permissionless deployERC20() call with a crafted denom embedding real token addresses, accepted because there was no collision check, then withdrawal batches 41572 to 41575 signed by validators.
- Attribution: none.
- Response: validators halted the bridge. No compensation plan or restart date published.
Sources
- https://rekt.news/gravity-bridge-rekt
- https://cointelegraph.com/news/cosmos-based-gravity-bridge-halts-bridge-after-reported-54m-exploit
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.