Blockchain security firm PeckShield said on June 1, 2026 that 14 major cross-chain bridge exploits had already drained a combined $340.7 million this year. Based on the incidents cited in its alert, bridge infrastructure has become one of the most heavily targeted areas in crypto, with losses ranging from $180,000 to a single exploit worth $292 million.
Attackers are shifting beyond smart contract bugs
The core risk in bridge design is concentrated. A bridge typically locks assets on one blockchain and issues equivalent assets on another, which means it often sits on large liquidity pools and depends on verification systems, signing keys, and cross-chain messaging layers to move value safely. If one of those components fails, a large pool can be emptied quickly.
The report highlighted a clear shift in attack methods. Instead of focusing only on smart contract flaws, attackers are going after signing keys, RPC nodes, and cross-chain messaging infrastructure. Those weaknesses can be harder to detect through standard audits and may be missed until funds begin moving out.
The largest incident reached $292 million
Among the 14 cases, the biggest was the KelpDAO / LayerZero exploit on April 18, which caused losses of $292 million. The article cited Chainalysis as saying LayerZero had used a dangerously low 1-of-1 RPC quorum by default, allowing a single compromised node to authorize fraudulent cross-chain messages. The stolen value included pooled rsETH collateral used across multiple ecosystems.
Another incident hit Hyperbridge on April 13 for $2.5 million. In mid-May, the pace stayed high: THORChain lost $10 million on May 15, while Adshares Bridge lost $628,000 on the same day. Verus-Ethereum Bridge was drained of $11.4 million on May 18, and Squid Router lost $1 million on April 7.
Aggregators and interoperability layers were also hit
The list was not limited to conventional bridge products. TransitFinance, a DEX cross-chain aggregator, lost $1.88 million on May 13. TAC Cross-Chain Layer on TON’s side lost $2.8 million that same day. ZetaChain was exploited for $300,000 on April 27. Earlier in the year, CrossCurve lost $3 million on February 1, followed by IoTeX.io Bridge with $8.8 million in losses on February 21.
Late May added more cases. Gravity Bridge lost $5.4 million on May 30, with the article saying compromised signing keys were suspected rather than a code flaw. MapProtocol / ButterNetwork Bridge lost $180,000 on May 21, and Alephium TokenBridge lost $815,000 on May 31.
Infrastructure-layer exploits made up 63% of May losses
According to the figures included in the article, 63% of May losses came from infrastructure-layer attacks rather than smart contract bugs. Bridges also accounted for 41% of all May losses. Another number in the report said total crypto hack losses across all categories had exceeded $750 million by mid-April 2026.
That points to a wider risk than a single bridge interface. If a DeFi protocol depends on bridged assets as collateral or uses bridge infrastructure underneath, an exploit can hit connected positions as well. Audit status, multisig verification, protocol dependencies, and real-time security alerts are becoming central factors for market participants watching cross-chain exposure.