Blockchain security firm CertiK's latest figures, cited by Cointelegraph, show that total losses from crypto industry attacks in May 2026 plunged to just $68.3 million—a staggering near-90% decline from the $650 million recorded in April. This makes May the third month of 2026 where aggregate damages stayed under the $100 million threshold, hinting at a temporary easing of some security pressures.
Phishing and Recovery Gains
Approximately $2.6 million of the May losses stemmed from phishing attacks. Encouragingly, about $9.4 million in stolen funds were recovered or returned during the month, reflecting improved incident response and on-chain tracing capabilities across the ecosystem.
Attack Vectors and Prime Targets
Code vulnerabilities remained the dominant attack vector, accounting for roughly $45 million—or 66%—of total losses. Wallet or private key compromises caused another $13.7 million in damages. Cross-chain bridges continued to be a primary target, suffering $28.6 million in losses and representing 42% of the month’s total.
The single largest incident was the Verus Protocol bridge exploit, which drained $11.5 million, followed by THORChain with a $10.1 million theft. DeFiLlama data tallied 29 security events in May, of which 7 involved private key leaks, underscoring persistent weaknesses in key management practices.