According to CertiK data, the crypto industry suffered $68.3 million in losses due to hacking and exploitation in May, a significant decrease from approximately $650 million in April. However, cross-chain bridges, protocol code vulnerabilities, and private key leaks remained the primary sources of risk that month.

The two attacks resulted in the highest losses.

The biggest loss in May came from Verus Protocol, whose cross-chain bridge was attacked on May 18, resulting in a loss of approximately $11.5 million. Subsequently, THORChain also suffered an attack, resulting in a loss of approximately $10.1 million.

According to CertiK, these two incidents totaled over $21 million, accounting for a significant portion of the total losses that month. On May 30, Alephium Bridge and Gravity Bridge also experienced security incidents, resulting in losses of approximately $815,000 and $5.4 million respectively, both related to the acquisition of private keys.

Code vulnerabilities remain the most fatal.

In terms of attack methods, protocol code vulnerabilities remain the biggest source of losses. CertiK stated that losses due to code vulnerabilities in May amounted to approximately $45 million, accounting for about 66% of the total losses for that month.

Wallet and private key breaches ranked second, causing approximately $13.7 million in losses. DeFiLlama records show that there were 29 security incidents in May, 7 of which involved private key breaches.

Cross-chain bridges continue to be targeted

Cross-chain infrastructure continues to attract attackers. CertiK data shows that cross-chain bridge-related attacks caused approximately $28.6 million in losses in May, accounting for about 42% of the total losses that month, higher than most DeFi protocol categories.

CertiK also noted that while total losses declined in May, attack methods are changing. Researchers observed that attackers are increasingly utilizing AI-assisted malware, targeting code repositories and AI coding tools, which poses new security challenges to cross-chain systems and private key management.