$302 Million Lost to Crypto Scams, Hacks, and Exploits in May: CertiK

May 2025 witnessed a significant surge in cryptocurrency losses due to scams, hacks, and exploits, totaling over $300 million according to CertiK, a leading blockchain security firm. This represents a dramatic increase in illicit activity compared to previous months. The dominant factor contributing to these losses was the exploitation of code vulnerabilities, accounting for a staggering $229 million. This figure marks a phenomenal 4,483% increase compared to April’s losses from the same source.

The sharp rise in code vulnerability exploits is particularly noteworthy. While losses from this vector have generally decreased over recent years (from $1.3 billion in 2021 to $173 million in 2024), May’s figures indicate a concerning reversal of this trend. This highlights the ongoing challenges in securing smart contracts and decentralized applications.

Other significant contributors to May’s losses included phishing attacks, responsible for $47 million in stolen funds. Phishing scams typically involve tricking users into revealing their trading account or wallet credentials, granting attackers direct access to their assets. Private key compromises accounted for a further $11.6 million in losses, emphasizing the importance of secure key management practices. Finally, price manipulation schemes resulted in approximately $1 million in losses.

The most impactful single event in May was the Cetus Protocol exploit, which resulted in the theft of $225 million. The severity of this attack led Sui, the blockchain affected, to take the controversial step of pausing its operations, a drastic measure intended to contain the damage and prevent further exploitation.

CertiK’s findings underscore the persistent risks within the cryptocurrency ecosystem. The significant increase in code vulnerability exploits serves as a stark reminder of the ongoing need for robust security protocols, rigorous code audits, and user education to mitigate the threats posed by malicious actors. The diverse range of attack vectors highlights the multifaceted nature of the challenge and the need for a comprehensive approach to security.