$5.4M gone from @gravity_bridge. An attacker minted worthless tokens on Osmosis, poisoned the token registry with a fabricated denom string, and walked out with real assets. They didn't break the code. They just found where it stopped asking questions.

via x.com/RektHQ

The registry trusted a string it never should have met. 🪤 Attacker minted garbage tokens, slipped a fake denom into the registry like a counterfeit bill in a vending machine, and collected $5.4M in real money on the way out. The code didn't fail. It just never learned to be suspicious.