An early Saturday security breach has led to the suspension of the Gravity Bridge, a cross-chain link between Ethereum and Cosmos, after approximately $5.4 million in digital assets were illicitly withdrawn. On-chain analysts detected unusual transaction patterns that pointed to a possible compromise of the bridge’s signing keys, rather than a flaw in its smart contract code.
Security firm PeckShield reported that the stolen funds included roughly $4.3 million in USDC, 274 wrapped ether valued at about $553,000, $434,000 in USDT, and 14.16 PAXG worth around $64,000. The attacker’s wallet, ending in 7C62da1F9, still held over 2,100 ETH, valued near $4.23 million, at the time of the report. A portion of the loot was moved through ChangeNow and Binance.
SpecterAnalyst, a prominent on-chain analyst, first flagged the incident, noting that the withdrawal pattern suggested the attacker used compromised authorization keys rather than exploiting the contract logic directly. The affected bridge contract was identified by an address ending in 1F2D906.
The Gravity Bridge team confirmed the incident on X, instructing validators to halt their validators and orchestrators immediately. In a subsequent update, the team stated that the bridge had been completely paused while an investigation into the attack is underway. No official postmortem has been released, leaving the exact entry point unconfirmed.
If confirmed, this breach would join a string of 2026 bridge attacks where key-management failures were central, as seen in earlier incidents involving Kelp DAO and Resolv. TRM Labs data indicates that bridge attacks remain a leading cause of crypto losses this year. While the $5.4 million loss is smaller than historical breaches like the $190 million Nomad exploit in 2022 or the $81.5 million Orbit Bridge hack in 2024, it underscores ongoing vulnerabilities in cross-chain infrastructure.