Chaincatcher Crypto Sector Suffers $68.3M Losses from Scams in May 2026
Article Content
- •Total losses in May 2026 reached $68.3 million, a 90% drop from April.
- •Phishing attacks accounted for approximately $2.6 million of the losses.
- •The Verus Protocol and THORChain attacks were the largest incidents, causing $11.5M and $10.1M losses, respectively.
In May 2026, the cryptocurrency industry experienced losses totaling approximately $68.3 million due to scams and exploits, marking a significant decline of nearly 90% from April's $650 million. The losses stemmed from 60 confirmed incidents, with phishing attacks accounting for about $2.6 million. Major incidents included the Verus Protocol attack, which resulted in $11.5 million lost, and THORChain, which lost $10.1 million. The report from CertiK indicates that while large-scale attacks have decreased, risks from phishing and credential leaks are on the rise. Funds recovered during this period amounted to $9.4 million, representing about 13.7% of the total losses. The data highlights a shift in attack vectors, with code vulnerabilities being the primary target. This trend reflects a broader concern about the security landscape in the crypto sector.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (76)
Following this threat?
Track Lazarus Group and Balancer in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails… 
Lazarus Group Linked to PHP Vulnerability Exploitation Plans A cybersecurity report from Cyfirma indicates that a group suspected to be linked to North Korea's Lazarus Group is preparing to exploit critical vulnerabilities in PHP, specifically CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The attackers, communicating in Korean, are…