May 2026: When the Bug Stopped Being in the Code

May 2026 reads, on paper, as the calmest month for crypto theft in over a year. That reading is wrong. The total fell because the era of nine-figure smart-contract exploits paused — not because crypto got safer. What replaced it is harder to audit and harder to insure: the systematic compromise of the keys, signers, and cross-chain trust layers that sit above the code.

The headline — and why it's misleading

Crypto lost roughly $82 million across at least 40 separate incidents in May, an 87.4% drop from April's record $647M. The mean incident was ~$2.0M; the median just ~$200K — a distribution skewed by a handful of governance and bridge failures.

April's total was inflated by two DPRK-linked nine-figure incidents (Kelp DAO, Drift). Strip those out and May looks less like a recovery and more like a change of method. The attackers didn't leave. They stopped breaking the code and started stealing the keys.

Where the money actually went

This is the chart that matters. Private-key, multisig and deployer-key compromises accounted for 43% of losses. Cross-chain, bridge and DVN failures for 34%. Classic smart-contract code bugs — the thing audits are built to catch — for only 13%. The dominant failure mode is no longer the contract. It's operational security and the trust assumptions between chains.

Six things worth knowing

• Loss volume normalized; incident count stayed high. $82M is low by 2026 standards, but 40+ incidents in a month is not a quiet market.

• Operational security dominated the dollars. Stolen keys and misconfigured multisigs (~$35M) plus broken bridges (~$28M) made up ~77% of all losses.

• BSC led incident count; Ethereum led dollar losses. BSC produced a long tail of small exploits; Ethereum absorbed the large ones.

• EIP-7702 abuse arrived in production. SQ Protocol on BSC is, to our knowledge, the first publicly documented live exploit using EIP-7702 account-delegation transactions.

• An old one-line bug keeps drilling holes. Two BSC tokens (MoneyMon, ONTR) fell within 24 hours to the classic "ecrecover returns the zero address" signature-check miss.

• Nation-state activity was indirect but present. No May incident drew high-confidence DPRK attribution, but Lazarus spent the month laundering April's $292M Kelp DAO proceeds through THORChain into Bitcoin.

The biggest incidents

• Verus–Ethereum Bridge — $11.58M. Missing source-amount validation let an attacker forge a cross-chain import worth millions for an input worth pennies. ~$8.5M was later returned; the rest kept as a bounty. Detected by Blockaid.

• THORChain — $10.7M. A node that joined two days earlier reconstructed a vault key by exploiting the protocol's GG20 threshold-signature scheme — a known weakness class it was years behind on patching. Flagged by ZachXBT and PeckShield.

• DxSale — $7.3M. ~1,400 dormant liquidity locks from the 2021 launch boom were drained via a privileged-fee mechanism and a backdated lock timestamp. Researchers suspect insider involvement.

• TrustedVolumes — $6.7M. An independent market maker running as a 1inch Fusion resolver was drained through a custom swap-proxy flaw. The same actor hit 1inch resolvers in 2025.

• Superfortune ($GUA) — $5.7M. An airdrop multisig payout was redirected to a look-alike address. Halborn ruled out the "address poisoning" the team first blamed. $15.18M minted, $5.7M realized.

• SquidRouterModule — $3.2M. A malicious third-party Safe module accepted a publicly known string as authorization and drained 86 trusting wallets. Neither Squid nor Safe built it.

• StablR (USDR/EURR) — $2.8M. A compromised key in a 1-of-3 minting multisig let the attacker remove both legitimate owners and mint millions of unbacked stablecoins. EURR briefly depegged to $0.85.

Two of the top ten — Verus and TAC Protocol — returned most of the funds through white-hat negotiation. Kelp DAO's $292M is excluded from May's numbers; its on-chain event was 18 April.

The geography of the losses

The chains tell two different stories depending on whether you count dollars or incidents. Ethereum absorbed the most value — roughly $28M across about 12 incidents — because the large, high-value targets land where the liquidity sits. BSC produced the most incidents (around 11), but almost all were small smart-contract exploits: a long tail of MoneyMon-, ONTR-, SKP- and Joe Agent-scale losses that rarely clear $100K. Arbitrum is the mirror image of Ethereum — five separate incidents (Stake DAO, Aurellion, ShapeShift, Renegade.fi, Sharwa) for barely $1M combined. And THORChain's $10.7M is shown on its own, because that single exploit spanned Bitcoin, Ethereum, BSC and Base at once. Multi-chain incidents are counted under their primary settlement chain, so the bars sum to the attributable subset rather than the full monthly total.

Three trends that define the month

• Bridges and cross-chain messaging are still the biggest target. PeckShield counted eight major bridge exploits draining a cumulative $328.6M across 2026 through mid-May. May's Stake DAO incident weaponized the same LayerZero configuration surface as April's Kelp DAO hack. Solv Protocol and Kelp DAO both announced migrations to Chainlink CCIP, moving $700M+ in tokenized BTC off LayerZero.

• AI agents and the software supply chain are the fastest-rising vector. The TrapDoor campaign planted 34 malicious packages across npm, PyPI and Crates.io — and hid instructions inside .cursorrules and CLAUDE.md files to turn AI coding assistants into credential thieves. The Bankr AI-wallet breach ($440K) and a Grok prompt-injection incident showed attackers exploiting the trust layer between automated agents, not the contracts beneath them.

• EIP-7702 made its forensic debut. SQ Protocol on BSC used the new account-delegation transaction type to seize ownership of a staking contract. Every protocol that gates ownership on a single externally-owned account is now inside this attack surface.

"I now consider all of DeFi unsafe." — Manuel Aráoz, OpenZeppelin co-founder (who left the company in 2019), writing on X on 26 May amid the Stake DAO incident. His argument: coding agents are now superhuman at finding bugs, and smart-contract security is fatally asymmetric — defenders must fix every flaw, attackers need one.

Who caught it — and who got their money back

Detection now runs through a handful of specialized on-chain monitors. Blockaid alone publicly attributed 11+ May incidents in real time, with SlowMist, PeckShield, ZachXBT, BlockSec, TenArmor, GoPlus and Socket covering the rest. A structural problem persists underneath: sub-$1M incidents almost never reach mainstream coverage and surface only through these firms and SlowMist's hacked database — exactly the gap a victim-facing radar exists to close.

Three names do most of the work. Blockaid has become the de-facto real-time alerting pipeline for Ethereum-family DeFi, flagging exploits as they unfold; PeckShield and SlowMist follow closely, and SlowMist's public hacked database remains the most complete archive of the smaller incidents nobody else bothers to log. Everyone after them — Lookonchain on fund-flow tracing, then ZachXBT, Halborn, TenArmor, GoPlus and ExVul — fills the gaps. It is a remarkably thin layer of specialists holding up incident visibility for the entire market, which is precisely why a single missed alert can leave an incident undocumented for days.

Recovery was sharply bimodal — and the deciding factor was the response pathway, not the size of the loss. Incidents caught live with an open negotiation channel (Verus, TAC, Adshares, Renegade.fi, Bankr) returned 73–90%. Incidents where attackers swapped to ETH and mixed immediately — or struck on a privacy chain like Monero — returned effectively nothing.

What to do about it

• If you run a protocol with privileged keys: kill single-account admin authority on minting and bridge configuration. Require at least 2-of-N multisig with a 12-hour timelock between a config change and its effect. And deprecate legacy contracts properly — "no longer used" is not a security state.

• If you operate cross-chain: never deploy with a 1/1 DVN; validate that source and destination amounts match on every message; audit abi.encodePacked with dynamic fields.

• If you build AI-agent or auto-wallet systems: decouple natural-language output from financial actions absolutely. Enforce transfer caps, source whitelists and human confirmation on anything that moves value.

• If you're a developer: pin your lockfiles, audit any dependency added between 19–25 May, and treat Rust build.rs scripts and .cursorrules / CLAUDE.md files as executable, untrusted code.

• If you're a user: never click sponsored Google results for crypto platforms — bookmark the real URLs — and revoke unused token approvals weekly.

A few caveats

• Reported totals vary by source: $81.7M (Phemex/PeckShield) to $84.2M (Cryip). We use the conservative figure.

• Kelp DAO's $292M is excluded from May statistics — its on-chain event was 18 April; only the post-mortem fell in May.

• Superfortune is charted at its $5.7M realized figure, not the $15.18M nominal mint.

• A few sub-$1M incidents (Sharwa.Finance, SmartCredit) have no published post-mortem and are flagged as unconfirmed.

• No May incident carries high-confidence DPRK attribution at the time of writing.

All on-chain claims are independently verifiable on the respective block explorers. This report is informational and not financial, legal, or security advice.

0xposed Lab — Track. Document. Fight Back.