Back-to-back bridge exploits jolt DeFi

TLDR

Two fresh cross chain bridge hacks in Gravity Bridge and Alephium have shaken confidence in DeFis core infrastructure.

1. Gravity Bridge lost about $5.4 million and Alephiums TokenBridge around $815,000 within days, and both bridges have been halted while investigations continue.
2. These exploits extend a 2026 pattern where bridge and DeFi hacks have already drained hundreds of millions of dollars, pressured DeFi TVL, and reinforced institutional concerns about security.
3. The key things to watch are attacker fund movements, reimbursement plans, and whether bridges accelerate more trust-minimized designs instead of admin key or small guardian setups.

Deep Dive

1. What Just Got Hacked

Gravity Bridge, which connects Ethereum and Cosmos, was exploited on 30 May for roughly $5.4 million, including about $4.3 million in USDC, 274 ETH, $434,000 in USDT, and PAXG tokens, after a suspected signing key compromise reported by researchers. Validators halted the bridge and some funds were laundered through ChangeNow and Binance, while around 2,100 ETH reportedly remains in the attackers wallets.

Alephiums (ALPH) TokenBridge, built as a fork of Wormhole, was then exploited for around $815,000 across USDT, USDC, WETH and WBTC, and the attacker also minted about 13.7 million unbacked wrapped ALPH on Ethereum and BNB Chain according to Alephiums update and independent analysis. Alephium immediately shut down the bridge and is exploring ways to make affected users whole.

2. Why Bridges Are Systemic Risks

Bridges typically lock assets on one chain and mint representations on another, so any failure in key management or message validation can let attackers unlock everything at once. In Gravity Bridges case, the issue appears to sit at the authorization layer where a compromised key allowed valid-looking withdrawals; in Alephiums case, forged messages were observed and signed by guardians, according to the projects statement.

2026 has already been harsh for cross chain infrastructure. Analysts count at least eight major bridge exploits by mid May, with cumulative bridge losses around $328 million and broader DeFi hacks reaching about $606 million in April alone, as highlighted in institutional coverage and hack tallies summarized here. After an earlier KelpDAO bridge breach of roughly $290 million, DeFi total value locked fell from nearly $100 billion to about $86 billion in two days, including outflows from unrelated pools.

3. What Users Should Watch Next

In the near term, the main concrete risks are:

1. How and when the Gravity Bridge attacker moves the remaining roughly 2,100 ETH, which could create localized selling pressure if unloaded aggressively.
2. Whether the unbacked wrapped ALPH can be offloaded into any remaining liquidity, which is why Alephium has warned users not to provide liquidity or trade those pools until further notice.
3. The outcome of postmortems, reimbursement plans, and any relaunch under a redesigned bridge model.

For users and builders, the practical lens is to treat bridges as separate risk buckets from the underlying chains and to differentiate designs that minimize admin keys or small guardian sets in favor of more decentralized or light client based validation.

Conclusion

Back to back exploits on Gravity Bridge and Alephiums TokenBridge underline that cross chain bridges remain DeFis weakest link, even when contracts are audited. The immediate fallout is contained in dollar terms but amplifies a broader trend of frequent bridge failures, DeFi TVL drawdowns, and institutional hesitation. The next phase will hinge on how quickly teams harden key management and validation models and how cautiously users treat bridge risk in their DeFi stack.