Crypto exploit losses plunge 90% in May to $68.3 million
In brief
- May 2026 crypto exploit losses: $68.3 million, down 90% from April's $650 million.
- Cross-chain bridges: $28.6 million (42% of losses); code vulnerabilities caused 66% of incidents.
- Largest exploits: Verus Protocol bridge ($11.5M) and THORChain attack ($10.1M).
- Recovered or returned crypto: $9.4 million during May.
The month's largest breaches
Verus Protocol's cross-chain bridge exploit on May 18 accounted for the largest single loss of the month at $11.5 million. THORChain followed as the second-largest incident in mid-May with $10.1 million stolen. Both incidents underscore the persistent vulnerability of cross-chain infrastructure, even as overall losses declined sharply from April's catastrophic month.
April had set a grim benchmark. Excluding the $1.5 billion Bybit hack in February 2025, April saw the highest monthly losses recorded since March 2022, driven largely by a $291 million exploit of Kelp DAO. May's recovery, while substantial, still reflects an industry under siege.
Attack vectors and recovery
Code vulnerabilities accounted for approximately 66% of May losses, or around $45 million. Cross-chain bridges were the most targeted category, accounting for $28.6 million or 42% of May losses, while wallet or private key compromises were the second-most costly category at $13.7 million stolen.
DeFiLlama data shows there were 29 incidents in May, seven of which involved compromised private keys. Late-month attacks included the Alephium Bridge exploit for $815,000 on May 30 and the Gravity Bridge attack for $5.4 million, also on May 30, both stemming from compromised private keys.
On a positive note, roughly $9.4 million in stolen crypto was recovered or returned during May. Phishing attacks accounted for approximately $2.6 million of the total crypto stolen, a relatively minor vector compared to code flaws and key compromises.
