May crypto hacks caused $68.08M in losses across 47 incidents. See how Verus, TrustedVolumes, and StablR attacks unfolded on-chain.
In May, hackers stole $68.078 million across 47 incidents. That’s just 10.61% of April’s record $641.67 million. However, May saw no large-scale hacks like April’s KelpDAO (about $293 million) or Drift protocol ($285 million) incidents. DeFi accounted for the majority of losses, continuing the April trend.
Global Ledger summed up May hack data and analyzed three incidents across different sectors — bridge, liquidity provider, and stablecoin issuer.
Verus Bridge: $11.7 Million
Losses from the Verus-Ethereum bridge exploit equaled nearly 76% of all funds lost in bridge hacks in 2025. On May 18, the attacker stole:
- 1,625.37 ETH (~$3.44 million at the time of exploit).
- 103.57 tBTC v2 (~$8.06 million).
- 147,659 USDC.
The attack unfolded fast:
- The hacker triggered a 10 USDC call to transfer reserve assets to the drainer wallet.
- Within 30 minutes, their address received ETH, tBTC, and USDC.
- tBTC was swapped to ETH in under 4 minutes.
- USDC followed about 18 minutes later.
The incident report came out nearly 8 hours after the first move from the hacker’s address.
Verus-Ethereum bridge hack timing. Source: Global Ledger
TrustedVolumes: $5.87 Million
Liquidity provider TrustedVolumes lost $5.87 million in WETH, USDT, WBTC, and USDC on May, 7. To hide the trails, the hacker sent money to TornadoCash, RailGun, THORChain.
One of the exploiter’s addresses — 0x61…2d1c — still holds 1,122.1188 ETH (~2.25 million), as of May 29.
Hackers made first transaction in 13 minutes and 48 seconds, the first swap followed in about 10 minutes. The public report came 1 minute 49 seconds after that swap — 11 minutes 37 seconds after the first transaction.
The attacker then went quiet. Nearly 15 hours later, the first 0.1 ETH went into Tornado Cash. Twenty hours after that, the funds started moving via THORChain.
TrustedVolumes hack timing. Source: Global Ledger
StablIR: $2.8 Million
StablIR stablecoin issuer got hacked on May 23. EURR and USDR depegged, dropping to $0.85 and $0.4, respectively.
StablR attacker:
- Added their address as an owner to the USDR minting multisig wallet
- Thirteen minutes later, added the same address to the EURR minting wallet
- Within two minutes, executed the first unauthorized mint of 1,000,000 EURR.
In total, 8.35M USDR and 4.5M EURR were minted.
Later, funds were distributed across multiple addresses and routed through exchanges.
Private key compromises are one of the most damaging attack vectors in crypto. Last year, private key compromises accounted for 13.33% of attacks causing $959.68 million in losses.
To Recap
To conclude, May was much quieter than April in terms of total losses, largely because there were no mega-hacks comparable to KelpDAO or Drift. However, the incidents that did occur show a familiar lesson: attackers act quickly, while projects are way slower to detect, investigate, and respond.
The cases analyzed this month show that vulnerabilities can emerge across different parts of the ecosystem — from bridges to stablecoin issuers. As crypto services become more interconnected, real-time monitoring and incident response remain essential for reducing the impact of attacks and improving the chances of recovery.
