ChangeNOW's recent freeze is somewhat respectful to the industry, but out of the 5.4 million dollars, only 90k was frozen, and the attacker's wallet is still active. The security model of the bridge really needs to be reviewed.

According to Specter’s post, the $91k of stolen funds from Gravity Bridge have been frozen by ChangeNOW; the attacker still holds most of the funds and has not transferred them out. Previously, it was reported that the bridge contract key was leaked, resulting in approximately $5.4 million in assets being stolen. The extracted assets include $4.3 million USDC, 274 WETH (about $553k), $434k USDT, and $64k PAYG. The involved addresses are 0x7B58...1F9 and 0x4d3c...A47.