Crypto exploits and breaches: January to May 2026

Originally published as “All 74+ Crypto Exploits, Hacks and Breaches So Far in 2026”

This is the deeply sad list of crypto exploits, breaches and hacks so far in 2026.

And this only covers the publicly known and discussed incidents up to May 30.

“Every single exploit” is almost impossible to define cleanly in crypto. Trackers such as DefiLlama, rekt. news, PeckShield, CertiK, Halborn, MASTR, Phemex, CCN, Nominis, Chainalysis, TRM, ZachXBT, and other security sources track dozens of incidents every month, including major protocol exploits, bridge failures, exchange wallet drains, private key compromises, oracle manipulation, admin key abuse, poisoned developer tooling, social engineering and smaller flash loan attacks that sometimes get fixed or partially recovered quickly.

DefiLlama alone tracks exploits across 75+ chains and 233+ techniques. Exact transaction hashes, attacker addresses and full fund flows are not always public immediately, especially for smaller incidents under $500K or incidents that are recovered quickly. But the major cases already have enough public on chain data to show the pattern clearly.

But even if we only look at the publicly discussed and notable cases, the picture is already ugly.

Q1 2026 reportedly had around 34 incidents and roughly $137M to $169M in DeFi and protocol losses, depending on the tracker and methodology. April then turned into a disaster month, with around 28 to 30 incidents and roughly $600M to $635M in losses, mostly driven by 2 massive exploits. May continued the same direction, especially through bridge attacks, signing failures and private key compromises. By late May, publicly tracked DeFi and protocol losses were already moving toward roughly $850M to $1B. If broader scams, phishing and social engineering cases are included, the number gets even worse.

Some summaries put bridge related losses alone around $328M+ across 8 major bridge incidents. Recovery rates remain weak overall, often somewhere around 10% to 40%, depending on whether teams manage to freeze funds, negotiate bounties, use treasury coverage or recover assets through white hat returns.

The repeating pattern?

Private keys keep failing. Admin keys keep failing. Bridges keep failing. Oracles keep failing. Governance keeps failing. Closed source systems keep hiding catastrophic assumptions. Social engineering keeps beating audits. Teams keep shipping systems that are called decentralised in marketing but still rely on fragile signing setups, privileged access, trusted operators, weak monitoring and human processes that collapse under pressure.

Funds often move in less than 1 hour. They get bridged, swapped, consolidated, laundered through mixers, THORChain, Umbra, ChangeNow, Binance, DEXs, cross chain routes and whatever other liquidity path is available before the average user even knows something happened.

➡️ January 2026

🔺 January 3 to 5: TMXTribe or TMX

Reported loss: Around $1.4M

What happened: The incident was described as a contract logic loop issue. In simple terms, the attacker abused flawed contract logic that allowed value to be extracted in a way the protocol should never have permitted. This is exactly the kind of exploit that shows why “the contract is live” does not mean “the contract is safe.”

Relevant details: Public reports list it among early 2026 contract logic failures. Full on chain transaction data was not widely included in the summaries I found, which is common for smaller or quickly contained exploits.

🔺 January 8: Truebit

Reported loss: Around $26M to $26.6M

What happened: Reports describe this as a smart contract or integer overflow issue in an old legacy Ethereum contract. Integer overflow bugs are one of the oldest classes of smart contract failures. When old code still controls real value and nobody treats it as active risk, it can become an extremely expensive time bomb.

Relevant details: This was one of the largest January incidents. The root cause was described as a legacy smart contract integer overflow. Partial recovery status was unclear in public summaries.

🔺 Around January 20: Makina Finance

Reported loss: Around $4.1M to $5.1M

What happened: Makina Finance was reportedly hit through a flash loan oracle attack. The attacker used temporary capital to manipulate pricing assumptions and drain value from the protocol. This is not a new attack category, which makes it worse. DeFi has seen this pattern for years, but protocols still ship with oracle designs that break under manipulated liquidity conditions.

Relevant details: The incident fits the classic flash loan plus oracle manipulation pattern. The attacker does not need long term capital. The attacker only needs weak pricing logic and temporary liquidity distortion.

🔺 January 21: SagaEVM

Reported loss: Around $7M

What happened: This was reported as a supply chain or inherited bridge vulnerability. The important part is the word inherited. Crypto projects often build on existing components, bridges, libraries and integrations. When 1 layer carries hidden risk, every project depending on it can inherit the blast radius.

Relevant details: Public summaries describe it as an inherited bridge or supply chain style vulnerability. This matters because bridge and dependency risks do not stay isolated inside the project where the original weakness was introduced.

🔺 January 25: SwapNet

Reported loss: Around $13.3M to $13.4M

What happened: SwapNet was reportedly exploited through arbitrary call and unlimited approval issues in a closed source multi chain system. Arbitrary call permissions are extremely dangerous when not strictly controlled, because they can allow attackers to execute actions that users or the system never intended.

Relevant details: SwapNet was linked to a broader vulnerability family affecting multi chain systems. The fact that it was closed source made public verification slower and harder. Closed source infrastructure can hide broken trust assumptions until attackers reveal them on chain.

🔺 January 25: Aperture Finance

Reported loss: Around $3.67M

What happened: Aperture Finance was linked to the same vulnerability family as SwapNet. This matters because exploit families often repeat across projects. When 1 design pattern is broken, attackers look for every similar implementation before the industry even finishes writing its first post mortem.

Relevant details: Reported as part of the same arbitrary approval or vulnerability family. This is how exploit contagion works in crypto: one broken pattern becomes a shopping list for attackers.

🔺 January 2026: Resolv Labs

Reported loss: Around $23M to $25M

What happened: Resolv Labs and its USR stablecoin system were reported with a private key or minting flaw. Some reports place the incident window in January, while fuller details appeared later. The core issue was reportedly unbacked minting and value extraction. When minting authority is compromised, a stablecoin or synthetic asset can become dangerous almost instantly.

Relevant details: Later reporting around March described unauthorised minting, unbacked USR and ETH extraction. The timing varies across public summaries, but the security category stays consistent: private key or minting authority failure.

🔺 January 31: Step Finance

Reported loss: Around $27M to $30M, with some broader treasury estimates reaching up to around $40M

What happened: Step Finance was reportedly hit through a treasury or private key compromise on Solana. Partial recovery was later noted, including around $4.7M in clawback in some reporting. But the damage pattern is still familiar: one compromised key, one weak treasury setup, and suddenly users are reading recovery updates instead of using the product.

Relevant details: The attack was described as a treasury private key compromise, likely phishing or social engineering related in some summaries. Funds were moved quickly. Team response reportedly involved pause or treasury swap style recovery actions. Net impact may have been lower after partial recovery, but the root failure remains private key control.

🔺 January 2026: Solv Protocol

Reported loss: Around $2.7M to $2.73M

What happened: Solv Protocol was reported with a reentrancy double mint issue involving token standards such as ERC 3525 or ERC 721. Reentrancy remains one of the most embarrassing recurring exploit categories in crypto because the industry has known about it for years. Yet it still appears in new forms when complex token logic is rushed or misunderstood.

Relevant details: Some trackers place this incident in January, while some summaries mention it again in March. Either way, it belongs to the 2026 exploit list and reflects a recurring smart contract logic failure.

🔺 January 2026: HoldstationW

Reported impact: Smaller incident, private key related in tracker summaries

What happened: HoldstationW was mentioned in broader exploit lists as a private key related incident. It did not dominate headlines, but private key compromise is one of the most repeated patterns in 2026.

Relevant details: Full public transaction data was not widely surfaced in the supplied summaries.

🔺 January 2026: Kokomo Finance

Reported impact: Smaller or less discussed case

What happened: Kokomo Finance appeared in the broader tracker summaries as an unaudited or lower visibility exploit case. These incidents matter because unaudited or weakly reviewed systems often become easy test environments for attackers.

Relevant details: No widely repeated tx hash was included in the public summary set provided.

🔺 January 2026: Odin.Fun

Reported impact: Smaller or less discussed case

What happened: Odin.Fun was included among the smaller January cases. Smaller incidents often disappear quickly from public discourse, but they still contribute to the same structural picture.

Relevant details: Full public post mortem or detailed transaction set was not included in the supplied data.

🔺 January 2026: TMXTribe variants and other smaller cases

Reported incidents: Additional smaller contract logic, private key, unaudited contract and exploit variants

What happened: These were mentioned in broader tracker summaries. They may not all dominate headlines, but they matter because smaller incidents are often where attackers test patterns before larger damage happens elsewhere.

Relevant details: Many smaller tracker entries either recover fast, lack full public post mortems or do not have widely cited transaction hashes in public summaries.

🔺 January 2026: BTC and LTC hardware wallet social engineering case

Reported loss: Around $282M to $284M

What happened: This case is often included in broader crypto loss discussions, although it was more a social engineering or phishing event than a protocol exploit. A hardware wallet user was reportedly tricked or compromised in a way that led to a massive BTC and LTC loss. This is the uncomfortable part nobody likes to say clearly: perfect code does not save users from social engineering, and self custody without operational security can still end in disaster.

Relevant details: This is not a protocol level smart contract exploit, but it belongs in any honest security discussion because social engineering is one of the dominant real world crypto attack paths. It shows that hardware wallets help, but they do not magically fix human process, transaction verification, address poisoning, signing deception or operational compromise.

➡️ February 2026

🔺 February 1 to 9: CrossCurve

Reported loss: Around $3M

What happened: CrossCurve was reportedly exploited through missing validation or bridge receiver access control, including fake Axelar message style issues. This is another bridge class failure. If cross chain messages are not validated correctly, attackers can convince one chain that something legitimate happened elsewhere when it did not.

Relevant details: The mechanism was reported as bridge access control failure and fake message validation. This is one of the most dangerous cross chain patterns because wrapped assets and receiver contracts depend on trusted message integrity.

🔺 February 15: Moonwell

Reported loss: Around $1.78M to $1.8M

What happened: Moonwell was reportedly hit through an oracle misconfiguration. Oracle failures are especially dangerous in lending and collateral systems because wrong pricing can turn fake or manipulated value into real withdrawals.

Relevant details: Public summaries identify the root as oracle misconfiguration. The attack belongs to the broader 2026 pattern of pricing systems failing under adversarial conditions.

🔺 February 21: IoTeX ioTube Bridge

Reported loss: Around $4.4M

What happened: The IoTeX ioTube Bridge was reportedly exploited through a private or validator key compromise on Ethereum, with around 410M CIOTX reportedly minted. A bounty was discussed. Again, the core problem was not a mystical blockchain failure. It was key and validator trust becoming a single point of failure.

Relevant details: Reports describe validator key compromise and unauthorised minting of around 410M CIOTX. This again places bridge signing infrastructure at the centre of the failure.

🔺 February 22: YieldBlox

Reported loss: Around $10.2M to $10.97M

What happened: YieldBlox was reportedly attacked through oracle manipulation in an illiquid market. Some reporting mentioned partial freeze or bounty efforts. The lesson is simple: illiquid markets are dangerous oracle inputs. If a protocol prices collateral from a market that can be moved cheaply, it is not secured by an oracle. It is secured by hope.

Relevant details: The attacker exploited weak pricing assumptions in an illiquid market. Partial freeze and bounty discussions were mentioned in reports, but full recovery was not clearly established in the supplied summaries.

🔺 February 2026: Hyperbridge overlap

Reported loss: Around $2.5M in some reports, mostly placed later in April

What happened: Hyperbridge appeared in some early February overlap reporting, but most detailed sources place the primary incident later. The important point is that the category was bridge and forged message related, which would become one of the defining themes of 2026.

Relevant details: Later reporting described missing MMR proof bounds and fake DOT mint mechanics. The timing is inconsistent across summaries, but the exploit class clearly belongs to the 2026 bridge failure trend.

➡️ March 2026

🔺 March 10: Aave related rsETH exposure

Reported figure: Around $27.78M in some leaderboards

What happened: Aave appeared in some exploit and bad debt leaderboards because of rsETH related exposure and contagion. This is not always described as a clean direct exploit against Aave itself, but it matters because DeFi is composable. One asset failure or bridge related unbacked asset issue can create bad debt and risk across protocols that integrated it.

Relevant details: Later Kelp DAO and rsETH related contagion discussions included Aave V3 exposure and bad debt concerns. In some reports, Aave’s bad debt exposure reached much higher in the Kelp context, including around $177M in affected markets. The key point is composability risk: one unbacked or compromised asset can infect lending markets.

🔺 March 15 to 19: Venus Protocol or Thena related issues

Reported loss: Around $2M to $3.7M

What happened: Reports described supply cap bypass, price manipulation or bad debt effects on BNB related markets. This again shows how collateral limits, price feeds and market design interact. If one assumption fails, attackers can turn protocol mechanics into a drain path.

Relevant details: Public summaries describe supply cap bypass, pricing abuse and bad debt effects. These are not isolated bugs. They are failures in the way protocol risk limits, asset pricing and liquidity assumptions interact.

🔺 March 22: Resolv Labs confirmed details

Reported loss: Around $25M

What happened: Resolv Labs was again reported or confirmed around this period, with unbacked USR minting and ETH extraction. The timing varies across sources, but the category stays consistent: private key or minting authority failure leading to unbacked assets and real losses.

Relevant details: The reported mechanism included private key compromise or unauthorised minting. Minted or reversed supply may have been partially frozen or corrected, but the ETH extraction and loss category remained material.

🔺 March 2026: Solv Protocol

Reported loss: Around $2.73M

What happened: Some trackers place the Solv reentrancy double mint issue here rather than January. Either way, it remains part of the 2026 list and fits the same problem category: complex token logic creating a path for value duplication or improper minting.

Relevant details: The exploit was tied to reentrancy and double minting. Public summaries mention ERC 3525 or ERC 721 style complexity. The incident shows that modern token standards add flexibility, but also additional failure modes.

🔺 March 2026: Foom Cash

Reported loss: Around $2.3M

What happened: Foom Cash was reportedly hit through a zk proof misconfiguration, with partial white hat recovery discussed. Zero knowledge systems are powerful, but they are not magic. If verification logic or proof assumptions are wrong, the cryptography becomes a very expensive decoration.

Relevant details: Reports describe a zk proof flaw or misconfiguration. Partial white hat recovery was mentioned. This is the exact kind of case where users should not confuse advanced cryptographic branding with secure implementation.

🔺 March 2026: Axios supply chain malware

Reported impact: Indirect developer tooling threat, not a direct protocol drain

What happened: Axios was mentioned in the context of package or supply chain malware. This type of event matters because attackers increasingly target the developer environment, not only deployed contracts. If build tools, packages or extensions are poisoned, attackers can reach protocols before the code ever touches production.

Relevant details: This is not a direct protocol drain in the same category as a bridge exploit. It is still relevant because developer tooling compromise can lead to malicious code insertion, credential theft, wallet compromise or poisoned releases.

🔺 March 2026: Other smaller incidents

Reported impact: Various smaller tracker entries

What happened: Several smaller events were tracked across public databases. Many receive little public attention because they are small, fast recovered or technically niche. But in aggregate, they reveal the same thing: the attack surface is everywhere.

Relevant details: Many smaller incidents do not have full public post mortems or transaction level breakdowns, but they fill the exploit background noise that major headlines hide.

➡️ April 2026

🔺 April 1: Drift Protocol

Reported loss: Around $285M

What happened: Drift Protocol was reportedly hit through a hybrid exploit involving social engineering, multisig or governance compromise, oracle abuse and fake collateral on Solana. Reports connected the incident to Lazarus linked activity, and it was widely discussed as one of the scariest incidents of the year because the human vector mattered as much as the technical side. This is the uncomfortable future of crypto security: attackers no longer need to only beat code. They beat teams, access workflows, signers, governance processes and operational trust.

Deep dive: Attackers reportedly posed as a quant firm and spent 6 to 9 months preparing. They allegedly tricked members of the Security Council into pre signing durable nonce transactions, a Solana feature that allows offline signatures to stay valid. A fake CarbonVote Token, CVT, was seeded and wash traded to around $1, then used as fake collateral. A test withdrawal reportedly happened around 16:05 UTC. The malicious admin transfer was executed in 2 transactions, around 1 second apart. Reports describe 31 withdrawals in roughly 12 minutes.

Key transaction: Admin transfer on Solscan: solscan.io/tx/2HvMSgDEfKhNryYZKhjowrBY55rUx5MWtcWkG9hqxZCFBaTiahPwfynP1dxBSRk9s5UTVc8LFeS4Btvkm9pc2C4H

Key transaction: Approval or execute transaction on Solscan: solscan.io/tx/4BKBmAJn6TdsENij7CsVbyMVLJU1tX27nfrMM1zgKv1bs2KJy6Am2NqdA3nJm4g9C6eC64UAf5sNs974ygB9RsN1

Attacker control address: H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL

Main drain reportedly started from: HkGz4Kmo...

Fund movement: Funds were reportedly bridged to Ethereum and laundered.

Response and status: Reports said the protocol itself complied with the exploit path and that it was not a classic smart contract bug. Audits did not prevent the operational and social engineering failure. Partial freezes and recoveries were limited. TVL reportedly fell heavily and the token dropped around 36%+. Most funds were considered gone in public reporting.

🔺 April 1 to 3: LML

Reported loss: Around $950K

What happened: LML was reportedly affected by liquidity exhaustion. This type of issue usually points to broken assumptions around available liquidity, redemption, pricing or pool mechanics. It may look smaller compared with the billion dollar scale failures, but it still exposes fragile protocol design.

Relevant details: Public summaries described this as a liquidity exhaustion event. Full transaction level data was not widely repeated in the supplied materials.

🔺 April 3: Silo Finance or Silo V2

Reported loss: Around $392K

What happened: Silo Finance was reportedly hit through an oracle misconfiguration. Once again, pricing assumptions became an attack surface. In DeFi, bad oracle configuration is not a minor admin mistake. It can become a withdrawal machine for attackers.

Relevant details: The attack was listed as oracle misconfiguration. Silo appears in April’s broader list of smaller and mid sized failures that were overshadowed by Drift and Kelp.

🔺 April 9 to 10: Aethir OFTAdapter

Reported loss: Around $90K to $423K

What happened: Aethir’s OFTAdapter was reportedly affected through bridge access control or cross chain issues. OFT and cross chain token adapters introduce serious risk because they depend on correct message validation, correct permissions and correct accounting across chains. When one of those pieces breaks, supply integrity breaks with it.

Relevant details: This was a bridge or cross chain adapter issue. The reported range varies by source, from around $90K to $423K or higher. Exact transaction level details were not consistently surfaced.

🔺 April 13: Hyperbridge

Reported loss: Around $2.5M, with initial figures around $237K later revised in some reports

What happened: Hyperbridge was reportedly exploited through missing MMR proof bounds, which allegedly enabled a large fake DOT mint attempt, described in some summaries as up to 1B fake DOT minted. Even if realised losses were smaller than the theoretical mint, the issue shows how catastrophic proof validation bugs can be in bridge and interoperability systems.

Relevant details: The exploit was described as forged message or proof validation failure. Hyperbridge Token Gateway was also separately listed in some summaries with around $237K, which may reflect early or partial accounting.

🔺 April 13 to 14: Dango

Reported loss: Around $410K to $1.9M

What happened: Dango was reportedly hit through a smart contract bug or positive amount check failure, with partial return discussed. Positive amount checks sound basic, but that is exactly the point. Many protocol failures come from simple validation mistakes hidden inside more complex systems.

Relevant details: Reports mention a smart contract validation bug and partial return. Full transaction level details were not widely included in the supplied data.

🔺 April 13 to 14: CoW Swap

Reported loss: Around $1.2M

What happened: CoW Swap was reportedly affected through a domain or DNS hijack. This is not a smart contract bug in the usual sense. It is infrastructure compromise. Users often think they are interacting with the right app, but if DNS, frontend hosting or domain control is compromised, the attack moves from contract logic to user interface deception.

Relevant details: The root issue was described as domain or DNS hijack. This belongs in the exploit list because frontend compromise can result in real wallet drains even if the core contract logic remains intact.

🔺 April 15 to 17: Grinex Exchange

Reported loss: Around $13M to $15M, with some reports up to around $19.4M

What happened: Grinex Exchange reportedly suffered a wallet or access drain involving TRON and Ethereum assets. Centralised or semi centralised wallet operations remain a major risk zone. When hot wallet access or operational signing is compromised, users do not get a technical debate. They get a drained balance sheet.

Relevant details: Reports describe a hot wallet drain, with laundering through SunSwap in some summaries. The amount varies across reports, roughly $13M to $19M.

🔺 April 16: Rhea Finance on NEAR

Reported loss: Around $7.6M to $18.4M

What happened: Rhea Finance was reportedly hit through oracle manipulation, fake liquidity or fake token mechanics. Some funds were reportedly frozen or partially recovered. The case again shows how liquidity, pricing and token validation can combine into a single failure path.

Relevant details: Some summaries mention around $9M frozen and around $4M ZEC shielded or unrecoverable. The exploit category was fake liquidity oracle abuse. This matters because shielded or privacy routed funds greatly reduce recovery odds.

🔺 April 18 to 21: Kelp DAO

Reported loss: Around $290M to $293M

What happened: Kelp DAO was reportedly hit through a LayerZero, RPC or bridge message spoofing issue involving unbacked rsETH across multiple chains. Reports discussed Lazarus linked activity and wider DeFi contagion, including Aave bad debt concerns. This was one of the largest incidents of 2026 so far. It shows the brutal risk of cross chain liquid staking assets: when backing, messaging or minting breaks, the damage does not stay politely inside one protocol.

Deep dive: The incident reportedly involved a LayerZero bridge RPC compromise and a forged cross chain message. The attacker allegedly created a phantom rsETH burn with no real backing, spoofed verification and released around 116,500 rsETH. The incident reportedly triggered Aave V3 bad debt or exposure concerns, with some reporting around $177M affected in Aave markets. Markets were frozen.

Key transaction: Main drain: 0x1ae232da212c45f35c1525f851e4c41d529bf18af862d9ce9fd40bf709db4222

Technical point: The transaction reportedly involved lzReceive on EndpointV2.

Attacker address: 0x5d3919f12bcc35c26eee5f8226a9bee90c257ccc

Status of that address: Reportedly involved in Arbitrum freeze activity.

Additional attacker address: 0xbb6a6006eb71a5c3c8c2c5d1c9d9c1c1d631c787

Funding source: Reports mention Tornado funding and 6+ attacker addresses.

Fund movement: Funds were reportedly deposited to Aave and Compound, then borrowed against. Reports mention 52K+ ETH borrowed, swapped through Uniswap and Kyber, around 74K ETH consolidated and around $175M routed toward THORChain or Umbra.

Response and status: rsETH contracts were paused across mainnet and L2s. A DeFi United style coalition reportedly recapitalised around 137K ETH from participants such as Arbitrum, Consensys and Mantle. Bad debt was reportedly covered and direct user losses were contained in public summaries. Some ETH, including 30K+ on Arbitrum, was reportedly frozen. Laundered portions remained unrecovered. AAVE reportedly fell around 19% during the contagion scare.

🔺 April 21: Volo Protocol on Sui

Reported loss: Around $3.5M

What happened: Volo Protocol was reportedly hit through a private key or vault ownership bypass. Most funds were reportedly recovered, with the net loss much lower in some reports, around $60K. Recovery helps, but it does not erase the underlying issue: vault ownership and privileged control paths are extremely dangerous when they can be changed or abused.

Relevant details: Reports mention 95%+ recovery and low net loss after recovery. The exploit category still points to privileged control failure.

🔺 April 29: SweatEconomy

Reported impact: Around 3.5M SWEAT supply drain on NEAR

What happened: SweatEconomy reportedly suffered a supply drain that was later handled through treasury restoration or pause mechanisms. This is another example of supply integrity risk. If a token supply can be drained, inflated or restored only through emergency intervention, the system is not as cleanly decentralised as marketing suggests.

Relevant details: The team reportedly restored via treasury or pause actions. That reduces user impact, but also shows the presence of emergency centralised control.

🔺 April 30: Wasabi Protocol

Reported loss: Around $5M to $5.9M

What happened: Wasabi Protocol was reportedly exploited through admin key compromise and UUPS upgrade abuse across multiple chains. Upgradeability is useful, but it is also dangerous. If an admin key can upgrade contracts into malicious logic, then the protocol is only as safe as that admin key.

Deep dive: Reports described admin key compromise and upgrade abuse, with no multisig or timelock protection strong enough to prevent the drain. The exploit reportedly affected vaults across multiple chains and drained funds before alerts could stop the attack.

Response and status: Partial freeze was mentioned in some reporting. Full recovery was not established in the supplied summaries.

🔺 April 2026: TMM or USDT on BSC

Reported loss: Around $1.6M to $1.7M

What happened: This case was reportedly tied to reserve manipulation or flash loan mechanics. It fits the broader April pattern of attackers abusing liquidity, accounting or reserve assumptions rather than needing to break the chain itself.

Relevant details: Public summaries describe a reserve manipulation or flash loan exploit on BSC.

🔺 April 2026: Aftermath Finance

Reported loss: Around $1.14M

What happened: Aftermath Finance was listed among the additional April incidents. The exact mechanics vary by summary, but it belongs to the broader category of protocol level exploit activity that made April one of the worst months ever for crypto security.

Relevant details: Detailed transaction data was not included in the supplied summaries, but it appears in the broader April exploit count.

🔺 April 2026: Purrlend

Reported loss: Around $1.5M

What happened: Purrlend was listed as another April exploit. Lending protocols remain attractive targets because pricing, collateral rules, liquidity and liquidation mechanics give attackers multiple possible paths to extract value.

Relevant details: Listed among April’s additional exploit incidents. Full public tx set was not provided in the supplied data.

🔺 April 2026: Giddy

Reported loss: Around $1.3M

What happened: Giddy appeared among April’s additional reported incidents. The lesson is not only about the amount. It is about the volume of failures. When 7 figure incidents become “smaller additions,” the industry has normalised a sick level of damage.

Relevant details: Included in broader April tracker summaries.

🔺 April 2026: Scallop

Reported loss: Around $140K to $150K

What happened: Scallop was listed among smaller April incidents. Smaller does not mean irrelevant. These events often expose the same classes of bugs that can later appear in much larger systems.

Relevant details: Included in smaller April exploit summaries.

🔺 April 2026: Judao

Reported loss: Around $228K

What happened: Judao was listed among April exploit activity. It adds to the count of mid sized and smaller protocol failures during the same month.

Relevant details: Included in broader April reporting.

🔺 April 2026: Singularity

Reported loss: Around $413K

What happened: Singularity was included among the added April cases. Again, the key issue is the density of incidents, not only the headline value.

Relevant details: Included in additional April exploit summaries.

🔺 April 2026: ZetaChain

Reported loss: Around $300K

What happened: ZetaChain was listed among the additional April incidents. Cross chain and interoperability environments generally carry more complex trust and validation assumptions, which is exactly where 2026 attackers kept looking.

Relevant details: Included in April cross chain or protocol incident summaries.

🔺 April 2026: Thetanuts

Reported loss: Around $50K

What happened: Thetanuts was listed among smaller April incidents. Even at lower loss levels, these cases matter because they show that exploit activity is constant, not rare.

Relevant details: Included among small April tracker entries.

🔺 April 2026: Juicebox V3

Reported loss: Around $52K

What happened: Juicebox V3 was listed among the smaller April exploit cases. Smaller protocol incidents often disappear from public discussion quickly, but they are part of the broader security landscape.

Relevant details: Included in smaller April exploit reporting.

🔺 April 2026: MONA

Reported loss: Around $61K

What happened: MONA was listed as another smaller April incident. The pattern remains the same: dozens of public failures across different ecosystems, not one isolated bad month.

Relevant details: Included in April’s smaller tracker cases.

🔺 April 2026: SubQuery

Reported loss: Around $60K

What happened: SubQuery was also included in the April additions. It reinforces the point that infrastructure and protocol adjacent systems are not outside the risk zone.

Relevant details: Listed among April’s smaller incidents.

🔺 April 2026: Hyperbridge Token Gateway

Reported loss: Around $237K

What happened: Hyperbridge Token Gateway was separately listed in some summaries. This again points to token gateway and bridge related risk, one of the clearest themes of 2026.

Relevant details: This may overlap with earlier Hyperbridge accounting in some reports, but it is still relevant because it highlights token gateway risk.

➡️ May 2026

🔺 May 4 to 14: TrustedVolumes

Reported loss: Around $5.87M to $6.7M

What happened: TrustedVolumes was reportedly exploited through a permissionless signer, authentication bug or unlimited approval issue in a closed source system. Closed source does not automatically mean unsafe, but when users cannot evaluate assumptions and privileged flows are broken, the damage arrives before the transparency does.

Deep dive: Reports described a permissionless signer issue, replay failure and unvalidated transfer mechanics. The system was described as a closed source RFQ related system for 1inch in some summaries. The core problem appears to have been broken authentication and transfer validation.

Response and status: Full recovery status was not clearly established in the supplied summaries.

🔺 May 14 to 21: THORChain

Reported loss: Around $10.7M to $10.8M

What happened: THORChain was reportedly affected by a malicious node or GG20 TSS vault key leak across multiple chains, leading to a network halt. This is a serious reminder that threshold signing, nodes and operational cryptography are not just abstract security architecture. If the signing layer fails, the protocol can be forced into emergency mode.

Deep dive: Reports describe a malicious node exploiting GG20 TSS vault logic or leaking enough signing material to reconstruct or abuse vault control. The attacker reportedly drained across chains.

Response and status: Network halted. Partial recovery efforts were ongoing in public summaries.

🔺 May 17 to 18: Verus or Versus Ethereum Bridge

Reported loss: Around $11.5M to $11.58M

What happened: This bridge was reportedly exploited through validation bypass, forged messaging or unbacked transfer mechanics. The attack class was compared to older bridge disasters such as Wormhole or Nomad style failures. The repeated lesson is brutal: bridge validation must be perfect, because attackers only need 1 broken assumption.

Deep dive: Reports described a mismatch between inputs and outputs and a missing checkCCEValues validation check. The attacker reportedly drained 103.6 tBTC, 1,625 ETH and 147K USDC, then swapped the assets into around 5,402 ETH.

Attacker address: 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9

Recovery transaction: 0xb428dae60a234c149c8bc4468979356c434726bf8f588b6c97bd7144aa5bcefe

Response and status: A bounty deal was reportedly reached. The attacker returned around $8.5M, approximately 4,052 ETH, and kept around $2.8M, approximately 1,350 ETH. Public summaries describe around 75% recovered.

🔺 May 19: Echo Bridge

Reported loss: Around $821K

What happened: Echo Bridge was reportedly affected by a private key issue. It is one of several May incidents where the root category was not exotic cryptography but key control.

Relevant details: Key compromise was listed as the main category. This may be separate from, or related to, the larger Echo Protocol fake eBTC minting incident.

🔺 May 19: Echo Protocol related admin key incident

Reported impact: Around $76M to $77M gross fake eBTC minted, with realised loss reportedly around $800K plus after burn or laundering

What happened: This separate or related Echo Protocol incident reportedly involved admin key compromise and fake eBTC minting. The realised loss was much lower than the gross fake mint figure, but the risk was massive. Fake minting events prove that supply integrity can depend on very fragile privileged access.

Relevant details: The huge gross fake mint number matters because it shows possible blast radius. Even when realised losses are lower after burn, freeze or laundering limits, the protocol’s minting trust model has already failed.

🔺 May 19 onward: RetoSwap

Reported loss: Around $2.7M

What happened: RetoSwap was reportedly hit through ACK frontrunning. Frontrunning is not only a trading annoyance. In some systems, transaction ordering and acknowledgement logic can become an exploit path.

Relevant details: Public summaries identify ACK frontrunning as the mechanism. This points to transaction ordering and protocol message flow as the attack surface.

🔺 May 19 onward: MAP

Reported loss: Around $110K

What happened: MAP was reportedly exploited through infinite mint and dump mechanics. Infinite mint bugs are among the clearest examples of catastrophic token logic failure. If an attacker can mint without legitimate backing or limits, the token economy can be destroyed instantly.

Relevant details: Included in May exploit tracker data as an infinite mint and dump case.

🔺 May 19 onward: Bankr

Reported loss: Around $170K

What happened: Bankr was reportedly affected through session keys. Session key risk is becoming more important as crypto apps move toward automation, agents and smoother user experiences. Convenience expands the attack surface when permissions are not tightly bounded.

Relevant details: Session key compromise or abuse was listed as the category. This matters more as agentic wallets and automated on chain tools become common.

🔺 May 19 onward: HermesVault

Reported loss: Around $30K

What happened: HermesVault was reportedly affected by rekeying issues. Rekeying and permission changes are sensitive operations. If attackers can alter control paths, they can move from access to extraction quickly.

Relevant details: Listed in May smaller incidents as rekeying related.

🔺 May 19 onward: Polymarket

Reported loss: Around $700K

What happened: Polymarket was mentioned with a private key related issue. Once again, the phrase “private key compromise” appears. That should bother people more than it does.

Relevant details: Public summaries list this as private key related. Detailed public post mortem and transaction set were not included in the supplied data.

🔺 May 23: StablR

Reported loss: Around $2.8M

What happened: StablR was reportedly affected by private key compromise, with around $13.5M in unbacked USDR and EURR minted and a smaller net drain after freezes. Stablecoin systems live or die by minting controls. When those controls are compromised, the word “stable” becomes marketing.

Deep dive: Reports describe private key compromise, unbacked minting of USDR and EURR, a larger gross mint and smaller net realised loss after freezes.

Response and status: Frozen assets were mentioned. Full final recovery was not clearly established in the supplied summaries.

🔺 May 23: Mure

Reported loss: Around $11.7K

What happened: Mure was reported as a smaller access related incident. Small size does not change the category. Access control failures are one of the most common and preventable exploit paths in crypto.

Relevant details: Included in May smaller tracker data.

🔺 May 24: Fractal

Reported loss: Around $13.7K

What happened: Fractal was reportedly affected by flash loan manipulation. Even smaller flash loan cases prove that protocols with weak pricing or liquidity assumptions can be attacked cheaply.

Relevant details: Listed as a flash loan manipulation event.

🔺 May 24 to 25: WUSD or Glove

Reported loss: Around $200K

What happened: WUSD or Glove was reportedly affected through Sybil activity. Sybil issues show that not every crypto exploit is a pure smart contract bug. Sometimes the failure is incentive design, identity assumptions or reward logic.

Relevant details: Listed as a Sybil related incident. This belongs in the broader exploit and abuse category even if it differs from a direct smart contract drain.

🔺 May 25 to 28: Gnosis users or safes, connected to New Market Trading

Reported loss: Around $3.2M to $3.98M

What happened: Around 88 safes across 3 chains were reportedly affected by access control issues or a missing require check. This is exactly the type of bug that sounds small in code review and devastating in production. One missing validation can become millions in losses.

Deep dive: Public summaries describe a missing require check in a module. Around 88 safes across 3 chains were reportedly affected. The incident shows that wallet modules and smart account extensions can become high risk if assumptions are not strictly enforced.

🔺 May 27: Stake DAO

Reported loss: Around $91K

What happened: Stake DAO was reportedly hit through a private key issue on Arbitrum. The amount is smaller than the major bridge disasters, but the category is the same: key security continues to be one of the biggest unresolved weaknesses in the space.

Relevant details: Listed as a private key issue.

🔺 May 28: DxSale

Reported loss: Around $7.3M

What happened: DxSale was reportedly exploited through an ownership override or legacy issue on BNB. Legacy code and old ownership mechanics are dangerous because teams often treat them as background infrastructure until attackers prove they are still active attack surfaces.

Relevant details: Reported as ownership override or legacy control path abuse. This is another privileged access failure.

🔺 May 29: VS Code poisoned extension supply chain threat

Reported impact: Indirect developer tooling threat, not a direct protocol drain

What happened: Poisoned VS Code extension activity was reported as a developer tooling risk. This matters because crypto attackers increasingly understand that compromising developers, tooling or deployment workflows can be more effective than attacking deployed contracts directly.

Relevant details: This was not a direct protocol drain, but it is relevant because developer tooling compromise can lead to credential theft, malicious code insertion, private key exposure or compromised deployments.

🔺 May 30: Gravity Bridge between Ethereum and Cosmos

Reported loss: Around $5.4M

What happened: Gravity Bridge was reportedly hit through suspected signing or private key compromise. USDC, ETH, USDT and PAYG were reportedly drained, some funds were laundered through Binance or ChangeNow, the bridge was paused and the attacker reportedly still held around $4.2M in ETH. This is another bridge incident in a year already full of bridge incidents.

Deep dive: The suspected issue was a signing or contract key compromise. Assets reportedly drained included around $4.3M USDC, 274 ETH worth around $553K, around $434K USDT and around $64K PAYG.

Theft address: 0x7B582033061b96cC3F9421e73a749ED7C62da1F9

Theft address: 0x4d3ca32e687e871a58b78AcAc73bE59AC37C7A47

Attacker holdings: Around 2,102 ETH, reportedly worth around $4.23M at the time of reporting.

Fund movement: Some funds were reportedly laundered through Binance, ChangeNow and swaps.

Response and status: Bridge paused. Tracking active. No full public post mortem was available yet in the supplied data.

🔺 May 30: Alephium TokenBridge

Reported loss: Around $815K drained, plus 13.76M fake or unbacked wALPH minted

What happened: Alephium TokenBridge was reportedly affected by guardian key or event validation issues across Ethereum and BNB. The bridge was paused, the team reportedly discussed compensation and users were advised around liquidity withdrawal. The key issue is not only the dollar loss. The fake wALPH mint shows that bridge accounting and wrapped asset supply can become untrusted very quickly.

Deep dive: Reports disagreed on the exact mechanism. Blockaid reportedly pointed to forged approvals or VAAs and guardian keys. The team reportedly denied guardian key compromise and suggested malicious events or another validation issue. Assets drained included USDT, USDC, WETH and WBTC on Ethereum and USDT and WBNB on BNB.

Response and status: Bridge paused. Team reportedly said users would be compensated 100%. Liquidity withdrawal advice was discussed. Attacker cash out was reportedly blocked. A full post mortem was expected after the first public reports.

🔺 May 2026: SEA Token

Reported loss: Around $153K

What happened: SEA Token was listed as a flash loan related incident. Again, small compared with the giants, but part of the same monthly pattern.

Relevant details: Included in May tracker data as a flash loan related case.

🔺 May 2026: Other smaller ongoing cases

Reported incidents: Additional small cases involving flash loans, rekeying, session keys, access control bugs, Sybil mechanics and low value drains

Relevant details: Smaller cases under $500K often lack immediate post mortems, public transaction hash summaries or full recovery details. Many are paused, patched, partially recovered or simply buried under larger headlines.

This is not a list of random accidents.

f repeated structural weakness.

Bridges were one of the biggest failure zones, with some summaries flagging around 8 major bridge incidents and roughly $328.6M in bridge related losses. Private keys and admin keys were everywhere. Oracle manipulation kept appearing. Governance and multisig assumptions failed. Upgradeability became an attack path. DNS and frontend infrastructure were compromised. Developer tooling was targeted. Social engineering kept working. Lazarus and North Korea linked actors were discussed in several of the biggest cases, with some summaries attributing around 76% of major value losses to North Korea or Lazarus linked activity.

And the recovery picture is still poor.

Some teams pause contracts. Some freeze assets. Some offer 10% or 20% bounties. Some recover part of the funds. Some rely on treasuries. Some get lucky because an attacker returns money. Some never recover. But users still carry the damage, the uncertainty, the depegs, the bad debt, the halted chains, the frozen funds and the broken trust.

The industry loves to sell decentralisation, but too many systems are still controlled by keys, bridges, signers, upgrade admins, RPC assumptions, off chain infrastructure, rushed integrations and small groups of people with terrifying levels of access.

That is the real story of 2026 so far.

Not just hacks.

Not just exploits.

A public stress test of crypto’s security culture.