Crypto Losses Drop to $68 Million in May After Heavy April Exploit Wave

Highlights:

• Crypto losses fell sharply in May, dropping to $68 million after April’s heavy $650 million hit.
• Weak code caused most of the damage, while cross-chain bridges faced the biggest pressure.
• Verus Protocol and THORChain saw May’s largest attacks, losing about $21.6 million combined.

Crypto losses from hacks, scams, and exploits fell sharply in May, according to blockchain security firm CertiK. The company said on Sunday that confirmed crypto losses reached about $68.3 million during the month, a major drop from the $650 million reported in April.

CertiK said May was the third month this year in which crypto losses remained below $100 million. The decline came after a difficult April, when several large attacks pushed monthly losses to one of the highest levels seen in recent months.

About $2.6 million of May’s total losses came from phishing attacks. Phishing is a scam in which attackers trick users into revealing wallet access, passwords, or other sensitive information. CertiK also said around $9.4 million was recovered or returned during the month.

#CertiKStatsAlert 🚨

Combining all the incidents in May we’ve confirmed ~$68.3M lost to exploits with
~$2.6M of the total attributed to phishing.

After a particularly bad April, May is now the third month of 2026 to record losses under 100M$.

More details below 👇 pic.twitter.com/GSWTLKXWDH

— CertiK Alert (@CertiKAlert) May 31, 2026

Weak Code and Stolen Keys Drove Most May Crypto Losses

CertiK’s data showed that code vulnerabilities accounted for the largest share of losses in May. These weaknesses led to approximately $45 million in stolen funds, accounting for about 66% of the monthly total.

A code vulnerability means there is a weakness in a project’s smart contract or system. Hackers can use that weakness to move funds, change balances, or take control of assets. In crypto, this risk is serious because many decentralized finance platforms hold large amounts of user funds in smart contracts.

Wallet and private key compromises were the second-largest cause of losses in May. CertiK data showed that this category caused about $13.7 million in stolen funds. A private key works like the main password to a crypto wallet. If someone gets access to it, they can usually move the funds without needing approval from anyone else.

The data also showed that cross-chain bridges were the most affected area during the month. These bridges lost about $28.6 million, or 42% of total May losses. Cross-chain bridges help users move crypto between different blockchains, but they often become targets because they hold large pools of assets.

Verus Protocol and THORChain Led May’s Biggest Exploits

The largest single incident in May involved Verus Protocol’s cross-chain bridge. The exploit occurred on May 18 and resulted in about $11.5 million in losses. THORChain also suffered a major exploit in mid-May, with attackers stealing around $10.1 million from the protocol.

These two incidents show that bridge security remains a major concern for the crypto industry. Bridges play an important role in decentralized finance because they connect different blockchain networks. However, their design can also make them attractive targets for hackers.

Two other late-May cases involved Alephium Bridge and Gravity Bridge. Alephium Bridge reportedly lost about $815,000, while Gravity Bridge lost about $5.4 million due to compromised private keys.

The sharp decline in May losses provided the market with some relief after April’s heavy losses. Still, it does not mean crypto security risks have disappeared.