Crypto Hack Losses in May Dropped 40% from April, PeckShield Reports

Blockchain security firm PeckShield reports a 40% decline in crypto hack losses for May 2025 compared to April, with 20 major incidents totaling over $244 million in stolen funds.

In April, there were 18 major hacks that caused over $357 million in losses, PeckShield reported. The largest was a $330.7 million Bitcoin theft from an elderly U.S. citizen through social engineering. Other major exploits included the KiloEX hack, the Loopscale breach, and more.

The $220M Cetus Hack Was May 2025’s Largest

Here are the five biggest crypto hacks from May 2025:

• Cetus Protocol: $220 million stolen
• Cork Protocol: $12 million stolen
• Suspected North Korea-linked hack: $5.2 million stolen
• MBU token hack: $2.2 million stolen
• MapleStory hack: $1.2 million stolen

The month's largest incident targeted the Cetus Protocol on May 22. Hackers exploited a bug in the platform's multiplication handling, enabling them to drain liquidity pools. Cetus, a DEX on the Sui blockchain, managed to recover $157 million of funds through fund freezing by the Sui Network and Cetus Protocol, though over $60 million remains in the hacker’s possession.. 

The second-largest attack targeted Cork Protocol, a DeFi platform, where hackers exploited a smart contract vulnerability to steal 3,761 wstETH, valued at approximately $12 million.

Another major incident was flagged by ZachXBT, who reported a $5.2M hack on May 27. He believes the victim was targeted by North Korean hackers through malware that messed with wallet outflows.

Rounding out the list, attackers exploited a bug in Mobius Token (MBU) contracts on BNB Chain, causing a $2.2M loss. The Web3 game MapleStory Universe also lost $1.2M in a separate attack.

Ongoing Revelations: More Hacks Emerge

On June 2, 2025, Taiwan-based cryptocurrency exchange BitoPro confirmed a hack first detected by on-chain investigator ZachXBT. The exchange reportedly experienced $11.5 million in outflows in early May. In response to a BitoPro post, ZachXBT asked for clarification on the suspicious outflows, which had not been previously disclosed. He pointed to multiple unusual transactions from the company's hot wallets. Following the inquiry, BitoPro publicly acknowledged the breach.

The exchange stated that the attack occurred during a wallet system update, exploiting an older wallet. Upon detecting the issue, BitoPro moved funds to new wallets and blocked the attacker.

This serves as a crucial reminder that not all security breaches are reported immediately; some may only come to light weeks after the incident.