Crypto Exploit Losses Plunge 90% in May to $68.3M

Verus Protocol, THORChain Lead May’s Major Incidents

Despite the overall decline, several substantial attacks still occurred throughout May. The largest single exploit targeted Verus Protocol’s cross-chain bridge, resulting in losses of approximately $11.5 million. THORChain experienced the second-largest incident, with attackers stealing around $10.1 million from the protocol in mid-May.

An analysis of these attacks revealed that code vulnerabilities were the most costly security weakness. Flaws in smart contract code and protocol implementations accounted for approximately $45 million, representing about 66% of all losses. Wallet and private key compromises ranked as the second-largest category, contributing roughly $13.7 million in stolen assets.

Cross-chain bridges proved to be particularly attractive targets for cybercriminals, enduring approximately $28.6 million in losses, or 42% of the total value stolen during May. Decentralized finance protocols were the second-most targeted category.

A Rebound After Record Losses in April

This decline follows one of the most challenging periods for the industry in recent years. Excluding the record-breaking $1.5 billion Bybit hack in February 2025, April 2026 recorded the highest monthly losses since March 2022, totaling $650 million. One of the primary incidents contributing to April’s substantial losses was a $291 million exploit involving Kelp DAO.

Data from DeFiLlama documented 29 separate security incidents throughout May, with seven of these involving compromised private keys. This persistent threat underscores the ongoing need for robust security measures across the crypto ecosystem.

AI-Assisted Malware Emerges as a Growing Threat

Security researchers have also noted a concerning rise in malware developed with the assistance of artificial intelligence tools. During May, malicious actors specifically targeted cryptocurrency developers and AI engineers by compromising software repositories and manipulating AI-powered coding assistants. This new vector introduces complex challenges for detection and prevention.

The month concluded with further incidents, including the May 30 exploits on the Alephium Bridge and Gravity Bridge, resulting in losses of approximately $815,000 and $5.4 million, respectively. Both incidents were attributed to compromised private keys, highlighting the continued vulnerability of these critical access points.