Incidents by month
Crypto hacks and exploits in May 2026
17 incidents. Each links to a full write-up: timeline, OAK Techniques, attacker addresses and fund flow, with sources.
Incidents (17)
- Ill Bloom hack (Aug 2026): $5,690,922 — 2026-08-05 · loss $5,690,922 · OAK-T11.004 Insufficient-Entropy Key Generation
- DxSale hack (May 2026): $7.3M — 2026-05-29 · loss $7.3M · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- Superfortune hack (May 2026): $15.18M — 2026-05-27 · loss $15.18M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- Stake DAO exploit (May 2026): $91K — 2026-05-27 · loss $91K · OAK-T10.002 Message-Verification Bypass
- SquidRouterModule hack (May 2026): $3.2M — 2026-05-25 · loss $3.2M · OAK-T11.003 In-Use Multisig Smart-Contract Manipulation
- RetoSwap / Haveno hack (May 2026): $2.7M — 2026-05-21 · loss $2.7M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- MAP Protocol (May 2026): $110K — 2026-05-20 · loss $110K · OAK-T10
- EchoProtocol eBTC Bridge Signature-Verification Bypass and Unbounded Mint — Monad — 2026-05-19 — 2026-05-19 · loss $76.64M · OAK-T10.002 Message-Verification Bypass
- Verus ⇄ Ethereum Bridge (May 2026): $11.58M — 2026-05-18 · loss $11.58M · OAK-T10
- Nx Console VS Code extension hack (May 2026) — 2026-05-18 · OAK-T11.009 Trader-Tooling Supply-Chain Compromise targeting `.env` Private Keys
- THORChain exploit (May 2026): $10M — 2026-05-15 · loss $10M · OAK-T10.001 Validator / Signer Key Compromise
- LABtrade hack (May 2026) — 2026-05-14 · OAK-T3.004 Influencer-Amplified Promotion-and-Dump
- Roaring Kitty hack (May 2026): $2.86M — 2026-05-11 · loss $2.86M · OAK-T15.006 Impersonation via Verified Social-Account Compromise
- TrustedVolumes RFQ Authorization-Boundary Failure — Ethereum — 2026-05-07 — 2026-05-07 · loss $5.87M · OAK-T9.004 Access-Control Misconfiguration
- Kraken / Coinbase users hack (May 2026): $6.7M — loss $6.7M · OAK-T5.009 Physical-Coercion Extraction (Wrench Attack)
- DSJ Exchange hack (May 2026): $150M — loss $150M · OAK-T11.005.002 Fake-Custodian / Fake-Asset-Manager Fraud
- Dritan Kapllani Jr hack (May 2026): $19M — loss $19M · OAK-T4.007 Native-app Social Phishing on Engagement-Weighted Platforms