$244 Million Vanished in Crypto Hacks This May — Here’s Why Only 71% Was Recovered!

Key Insights

• Crypto hackers stole $244.1 million in May across 20 major incidents, a 39.29% decrease from April.

• The Cetus DEX exploit on May 22 accounted for nearly 90% of May's losses.

• $223 million was stolen due to a flaw in the most significant bits (MSB) check.

• Cetus and Sui Network successfully froze and recovered 71% ($157 million) of the funds stolen in the DEX exploit.

• Other significant May hacks included Cork Protocol ($12 million), a DPRK-linked attack ($5.2 million), and MBU Token Exploit ($2.2 million).

• Despite major incidents, the decline in hack volume from April and Q1 figures shows that security is improving.

The crypto space was a major target for cyber attackers in May, despite a marked decline in MoM losses.

According to recent insights from blockchain security firm PeckShield, hackers stole $244.1 million across roughly 20 major incidents. 

While this stands as a 39.29% drop from April’s figures, the number is still very concerning about how vulnerable the crypto space is to attack.

Cetus DEX Breach Dominated May’s Losses

One of the incidents that stood out from the rest was the exploit of the Cetus DEX on 22 May. 

This single attack accounted for nearly 90% of the total funds stolen from the exchange in May, with around $223 million lost within 24 hours.

According to security analysts from Dedaub, the attackers used a flaw in the most significant bits (MSB) check. 

This allowed them to drastically manipulate liquidity parameters and open massive positions using minimal input. 

In essence, they were able to drain liquidity pools that held hundreds of millions of dollars.

Fortunately, not all was lost. According to PeckShield, Cetus and its associated Sui Network were able to freeze around $157 million of the stolen assets. 

By doing so, they recovered 71% of the stolen funds and prevented the situation from becoming even worse.

Other Major Losses in May

While the Cetus attack took over the headlines, there were several other notable hacks.

For example, the second-largest hack involved the Cork Protocol, where hackers stole approximately 3,761 Wrapped Staked Ether (wstETH) worth around $12 million, which they later converted to Ethereum. 

In addition, the DPRK-linked hack was suspected to be tied to North Korea's Lazarus Group and cost around $5.2 million. 

The MBU Token Exploit, as well, resulted in $2.2 million in losses due to vulnerabilities in token contract logic.

Finally, the MapleStory Universe hack saw a loss of $1.2 million and completed the list of the top five exploits for the month.

Decline in Hack Volume

Despite so many protocols being hacked in May, the month saw an interesting decline in thefts compared to April, which saw over $400 million in losses.

This may be an indicator that crypto platforms are improving their security. 

It is also encouraging compared to February, when hackers stole $1.53 billion from the Bybit incident and a few others. 

This single incident alone accounted for over 92% of crypto losses in the first quarter of the year.

According to PeckShield, total losses in Q1 stand at more than $1.63 billion, with January contributing around $87 million. 

That means the May decline could be a major sign that the threats are becoming less severe.

Either way, industry vigilance should still be on high.

What Could Be Ahead?

Even though May showed signs of improvement, it is important that the crypto industry doesn’t let its guard down.

Hackers continue to improve their tactics every day, and are finding new ways to exploit minor mistakes in smart contracts and platform logic to cause major damage.

For now, it appears that the crypto industry is moving in the right direction with  faster response times, better collaboration and so on. 

However, the cat-and-mouse game continues, and both developers and users must be ready for anything.

Overall, 

May 2025 proved that while the total value of stolen crypto dropped, the threat is far from over. 

The Cetus DEX incident alone showed just how dangerous hacks can still be, but the successful freezing of 71% of those stolen funds also showed that safety might be improving.

Disclaimer: Voice of Crypto aims to deliver accurate and up-to-date information, but it will not be responsible for any missing facts or inaccurate information. Cryptocurrencies are highly volatile financial assets, so research and make your own financial decisions.