Crypto Exploit Losses Drop to $68M in May, Bridges Remain Top Risk

| bitcoinist.com
Crypto exploit losses fell sharply to about $68M in May, down from roughly $650M in April, according to CertiK data. Crypto exploit losses were driven mainly by code vulnerabilities, which made up ~66% (about $45M) of the month’s total. By sector, cross-chain bridges accounted for the largest share: 42%, or $28.6M. The biggest single hit was the May 18 Verus Protocol cross-chain bridge exploit, stealing $11.5M. THORChain followed with about $10.1M after an attack in mid-May that forced the protocol to halt trading. Wallet and private-key compromises were the next major driver, with $13.7M stolen via that route. CertiK/DeFiLlama flagged nearly 30 incidents in May, including seven tied to private-key exposure. Two later cases on May 30 were the Alephium Bridge (~$815K) and Gravity Bridge (~$5.4M). Phishing played a smaller role: $2.6M was attributed to phishing, while ~$9.4M was recovered or returned. CertiK also said May was the third straight month in 2026 with total losses under $100M. Separately, the report highlights a new threat: AI-assisted malware development, where attackers target code repositories and try to manipulate AI coding assistants into taking malicious actions—potentially expanding risks beyond traditional smart-contract exploits. For traders, the market signal is mixed: crypto exploit losses improved versus April, but bridge risk and key-compromise remain persistent, while AI-enabled tooling could raise tail risk later.
Neutral
Crypto exploit losses improved versus April (headline losses down sharply), which can support sentiment for the broader DeFi and exchange ecosystem in the short term. However, the composition of losses stayed concentrated in bridge infrastructure (42%) and key/private-key compromises ($13.7M), meaning the primary failure modes for on-chain interoperability and custody security are still present. The additional risk flag—AI-assisted malware targeting code repositories—adds uncertainty to the longer-term threat landscape. Overall, this is more of a risk-monitoring signal than a direct driver of sustained price repricing for any single listed coin.