Losses from cryptocurrency platform exploits decreased drastically in May, falling to $68.3 million, a sharp decline from April’s $650 million, according to security firm CertiK. This marks the third consecutive month in 2026 with losses below $100 million, indicating a potential easing of exploit-related damages.
Despite the lower overall losses, May still saw a range of significant incidents, including the largest exploit against Verus Protocol’s cross-chain bridge, which resulted in $11.5 million stolen. Another notable attack targeted THORChain, with $10.1 million lost in mid-May. Cross-chain bridges remained the most aggressive target, accounting for $28.6 million or 42% of total monthly losses.
Code vulnerabilities were responsible for the majority of losses, representing about 66% of the total or roughly $45 million. Wallet and private key compromises ranked second, with losses reaching $13.7 million. Phishing attacks contributed $2.6 million to the thefts, while around $9.4 million was either recovered or returned during the month.
Data from DeFiLlama indicated 29 exploit incidents in May, including seven involving compromised private keys. The two latest cases involved the Alephium Bridge and Gravity Bridge, exploited for $815,000 and $5.4 million respectively, both due to private key breaches.
In addition to conventional cyberattacks, May also saw a rise in malware developed with the assistance of artificial intelligence. Malicious actors targeted crypto and AI developers by compromising code repositories and manipulating AI coding tools, highlighting an evolving threat landscape.