Crypto scams cost $68.3 million in May 2026

The crypto industry lost $68.3 million to exploits and scams in May 2026, marking the third month this year with sub‑$100 million losses but still the highest incident count of the year at 60 separate attacks【2】.

What drove the May losses

The CertiK monthly report attributes the bulk of the $68.3 million loss to smart‑contract code flaws, which alone accounted for $45.13 million (about 66 % of the total)【2】. The two largest single‑attack losses were the Verus breach ($11.52 million) and a Thorchain exploit ($10.12 million), together representing roughly one‑third of the month’s total loss【2】. Phishing contributed $2.6 million, the second‑lowest phishing figure of 2026, down from a $331.3 million peak in January【2】.

Context and recovery rate

May’s loss figure is far below April’s $547.3 million spike and below the $97 million recorded in January, showing a downward trend after the April peak【2】. However, the recovery rate remains modest: only $9.38 million—about 13.7 % of the gross loss—was returned to victims during the month【2】. The report also notes that bridge exploits ($28.62 million) and DeFi protocol incidents ($23.92 million) were the top categories by dollar amount, underscoring the continued vulnerability of cross‑chain bridges and decentralized finance platforms【2】.

Token and incident breakdown

The top five loss incidents (Verus, Thorchain, TrustedVolumes, Victim 0x2cFED, and Gravity Bridge) together accounted for $39.55 million, nearly half of the total loss amount【2】. Smaller attacks on projects such as Stablr, New Market Trading, TAC, Ossie, and Haveno/RetoSwap each ranged between $2.70 million and $3.50 million, illustrating a broad distribution of exploit sizes across the ecosystem【2】.

What to watch

• Bridge activity – Monitor large‑scale bridge exploits, especially on Thorchain and Gravity Bridge, as they have repeatedly generated multi‑million‑dollar losses.
• DeFi protocol audits – Watch for upcoming security audits of high‑value DeFi contracts, given that DeFi incidents accounted for $23.92 million in May.
• Recovery efforts – Track the proportion of funds returned in future months; a rise above the current 13.7 % recovery rate could signal improved law‑enforcement or industry response.

The May numbers highlight that while total dollar losses have receded from the April surge, the frequency of attacks remains at a yearly high, and code vulnerabilities continue to dominate the threat landscape. Whether improved security practices can curb both the incident count and the dollar impact remains an open question.