Gravity Bridge, a Cosmos-native cross-chain protocol, lost roughly $5.4 million in a compromised-key attack over the weekend, marking the latest security breach in DeFi. Blockchain investigator Specter flagged the exploit on May 31, tracing it to a signing key compromise that allowed the attacker to forge signatures and drain funds.
The stolen haul included $4.3 million in USDC, 274 wrapped Ether valued at roughly $553,000, $434,000 in USDT, and 14.16 PAXG tokens worth about $64,000, according to Specter. Security firm PeckShield reported that the bad actor has already laundered a portion of the assets.
The exploit adds pressure on Cosmos ecosystem bridges, which have faced scrutiny after previous cross-chain hacks. The incident may draw renewed attention from regulators on key management standards for DeFi protocols, though no enforcement actions have been announced.
Gravity Bridge’s total value locked (TVL) has not been disclosed post-attack, but the $5.4 million loss represents a significant fraction of its pre-exploit TVL, which was estimated below $20 million. The incident has not triggered major sector-wide sell-offs, and Bitcoin (BTC) remains steady near $73,300.
Community reaction has focused on the need for multisig upgrades and hardware security modules; some developers argue that signing key compromises are a systemic risk that no single protocol can fully eliminate. The protocol has not yet announced a compensation plan for affected users.