What happened
On May 30, 2026, Gravity Bridge, which connects Ethereum and the Cosmos ecosystem, was drained of about $5.4 million in USDC, ETH, USDT, and PAXG after its bridge signing authority was compromised.
The failure was in signing-key custody and validator authorization rather than a defect in the bridge contract: compromised signing infrastructure produced apparently valid authorization for a malicious validator-set change and subsequent withdrawals.
Case & protocol details
Market Context at Time of Hack
Attack Timeline
Public on-chain reconstruction says an attacker induced the validator set to sign a change shrinking it from 58 to 34, concentrating control; the reduced set then authorized withdrawals from the Ethereum-side bridge.
Funds Recovery
Recovered
$1
Net Loss
$5.4M
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.