Crypto exploit losses fall 90% in May to $68.3M

Crypto exploit losses fell to $68.3 million in May, a nearly 90% drop from roughly $650 million in April, CertiK reported. May was the third month of 2026 with losses below $100 million.

CertiK posted the figures on X, recording 29 incidents in May. Seven incidents involved compromised private keys. About $2.6 million of the month’s total stemmed from phishing, and roughly $9.4 million was recovered or returned.

The largest single loss in May was an $11.5 million exploit of Verus Protocol’s cross-chain bridge on May 18. A mid-May attack on THORChain was the second-largest, with $10.1 million stolen. Cross-chain bridges accounted for $28.6 million, or about 42% of May’s total, followed by decentralized finance protocols.

Code vulnerabilities were responsible for roughly 66% of May’s losses, about $45 million. Compromises of wallets or private keys accounted for about $13.7 million. Two incidents reported on May 30 – the Alephium Bridge and Gravity Bridge – were exploited for about $815,000 and $5.4 million respectively, both linked to compromised private keys, according to CertiK and public incident trackers.

CertiK also flagged a rise in malware developed with AI assistance. The firm noted attackers compromised code repositories and manipulated AI coding assistants to introduce malicious code into development pipelines and open-source projects.

By comparison, April’s losses totaled about $650 million, excluding a $1.5 billion breach at Bybit in February 2025. April’s largest incident was a $291 million exploit of Kelp DAO.

CertiK’s data show a large decline in value stolen in May while multiple attack vectors remained active and some stolen funds were recovered. The firm reported that security teams continued to patch code vulnerabilities and strengthen key management.