Loading article…
Crypto scams lost $68.3 million across 60 incidents in May 2026, per CertiK. See the breakdown by attack type and what to watch next.
The crypto industry lost $68.3 million to exploits and scams in May 2026, marking the third month this year with sub‑$100 million losses but still the highest incident count of the year at 60 separate attacks【2】.
| At a glance | |
|---|---|
| Losses (May 2026) | $68.3 million |
| Incidents (May 2026) | 60 |
| Biggest loss per attack | $11.52 million (Verus) |
| Primary loss category | Code vulnerabilities ($45.13 million) |
The CertiK monthly report attributes the bulk of the $68.3 million loss to smart‑contract code flaws, which alone accounted for $45.13 million (about 66 % of the total)【2】. The two largest single‑attack losses were the Verus breach ($11.52 million) and a Thorchain exploit ($10.12 million), together representing roughly one‑third of the month’s total loss【2】. Phishing contributed $2.6 million, the second‑lowest phishing figure of 2026, down from a $331.3 million peak in January【2】.
May’s loss figure is far below April’s $547.3 million spike and below the $97 million recorded in January, showing a downward trend after the April peak【2】. However, the recovery rate remains modest: only $9.38 million—about 13.7 % of the gross loss—was returned to victims during the month【2】. The report also notes that bridge exploits ($28.62 million) and DeFi protocol incidents ($23.92 million) were the top categories by dollar amount, underscoring the continued vulnerability of cross‑chain bridges and decentralized finance platforms【2】.
The top five loss incidents (Verus, Thorchain, TrustedVolumes, Victim 0x2cFED, and Gravity Bridge) together accounted for $39.55 million, nearly half of the total loss amount【2】. Smaller attacks on projects such as Stablr, New Market Trading, TAC, Ossie, and Haveno/RetoSwap each ranged between $2.70 million and $3.50 million, illustrating a broad distribution of exploit sizes across the ecosystem【2】.
The May numbers highlight that while total dollar losses have receded from the April surge, the frequency of attacks remains at a yearly high, and code vulnerabilities continue to dominate the threat landscape. Whether improved security practices can curb both the incident count and the dollar impact remains an open question.
Coverage is mostly measured — 217 of 219 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 2 outlets · Jun 18, 2026 · How we report
A pig butchering Crypto Scam is a fraudulent scheme where perpetrators cultivate romantic or investment relationships with victims over weeks or months. Once trust is established, the fraudsters convince the victims to transfer funds into fake investment platforms.
As of September 9, 2026, the Scam Center Strike Force restrained approximately $52 million in laundered assets in a single day. This operation targeted the Xinbi Guarantee marketplace and contributed to a cumulative total of $938 million in frozen or seized assets since the task force launched in November 2025.
Revolut confirmed that no customer funds were touched during the data disclosure incident identified on September 11, 2026. The company stated that the breach involved the unauthorized release of customer identity and transaction data due to a sophisticated external impersonation scam.