DeFi Hacks Drove $302M in Crypto Losses in May Despite Drop in Scams, Says Certik

The crypto industry took a $302 million hit in May, primarily from hacks targeting decentralized finance (DeFi) platforms, according to blockchain security firm Certik. While that total marks a 16.9% drop from April, the majority of losses stemmed from vulnerabilities in smart contract code—a persistent challenge for the DeFi space.

Leading the damage was a $223 million exploit of Cetus Protocol, a decentralized exchange built on the Sui blockchain. That single incident accounted for more than 98% of the $229 million lost due to code vulnerabilities last month. In total, DeFi platforms suffered over $241 million in losses, though roughly $162 million was later recovered through a Sui community vote.

Certik’s analysis underscores a critical ongoing issue: coding flaws remain a prime target for attackers.

“While the spike in May is largely due to one outlier event, the broader trend is improving,” said Natalie Newson, Senior Blockchain Security Researcher at Certik.

She noted that total losses from code weaknesses have sharply declined from $1.35 billion in 2021 to about $173 million so far in 2024, pointing to the benefits of better security tools, including AI audits and real-time monitoring.

Phishing scams, another major vector for crypto theft, also saw a notable drop. These schemes caused $47.6 million in losses in May—an 86% decrease compared to April’s $337.3 million. Meanwhile, attacks involving compromised private keys led to about $11 million in additional losses.

Beyond Cetus, other significant breaches included Cork Protocol’s $12 million exploit, an $11.5 million hit to BitoPro, a $2.1 million breach at MobiusDAO, and nearly $1 million siphoned from Demex Nitron.