Did crypto hacks really drop 40% in May 2025?

The month of May 2025 has brought a glimmer of relief to the blockchain security world. According to a recent report from Cointelegraph (

), data from blockchain security firm PeckShield reveals that major crypto hacks fell by 39.3% from the previous month. With only 20 high-profile exploits recorded—totaling $244.1 million in losses—this marked a notable decline from April's figure of approximately $400 million. But does this downward trend signify a turning point, or are hackers simply regrouping?

Understanding the nuance behind these numbers requires looking beyond the surface. From improved smart contract auditing to deeper chain monitoring and incident response improvements, the ecosystem has been shifting—gradually but effectively—toward a more hardened security posture.

May’s figures were significantly influenced by two headline-grabbing incidents. The largest was the $223 million breach on Cetus DEX, which occurred within a single 24-hour period. According to on-chain data and analysis by

, a vulnerability in the swap pool logic allowed a malicious actor to drain funds rapidly. While roughly $157 million of that was subsequently frozen across exchanges, the initial shock still registered heavily.

Meanwhile, Cork Protocol suffered a $12 million attack that exploited a flawed wrapped staked ETH (wstETH) conversion function. This vulnerability allowed unauthorized asset redemptions by bypassing normal collateral checks. Protocol-specific issues like these are often the result of overly complex codebases, which make automated auditing more difficult—a challenge still being addressed by platforms like

and

.

For users trading and bridging assets across ecosystems like Sui or Ethereum, platforms like

can offer added transparency. Tools such as

help monitor transactional health and contract integrity across supported chains—critical during periods of network instability following an exploit.

Although $244.1 million is still a hefty loss, it’s a step down from April’s roughly $400 million. According to

and

, March alone saw over $580 million stolen in coordinated attacks, including bridge exploits and MEV manipulation. So far, 2025's first quarter losses exceed $1.6 billion, with February’s Bybit hack accounting for over 90% of that quarter’s toll.

This month’s lower numbers suggest that platforms and protocols may finally be learning from past mistakes. There has been a visible uptick in protocol upgrades, off-chain bug bounties, and a shift toward modular architecture—which limits the blast radius of smart contract failures. Community-driven auditing and whitehat feedback loops are also becoming more common, especially among smaller projects with limited security budgets.

Security innovation in Web3 is increasingly driven by real-time surveillance and artificial intelligence. Blockchain intelligence tools like

and

have enabled investigators to trace stolen assets within minutes of an exploit. More importantly, proactive monitoring through anomaly detection—leveraged by teams such as

—has helped flag protocol vulnerabilities before they can be weaponized.

AI is also being deployed to enhance risk scoring of new contracts and wallets. Platforms like

monitor on-chain activity in real time, flagging suspicious patterns that indicate pending flash loan attacks, phishing schemes, or mint logic exploits.

For users wanting to protect themselves, bridges like

simplify and verify cross-chain swaps, while

and

offer foundational cybersecurity education focused on wallet safety, contract analysis, and the use of watchlist tools.

Several of May's smaller exploits have been attributed to persistent threat actors. A $5.2 million exploit involving a token spoofing vulnerability on Solana has been linked to the Lazarus Group—North Korea’s notorious state-sponsored hacking unit—according to analysts from

. The group has also been tied to this year's earlier attacks on DeFi platforms and infrastructure layers.

Rug pulls and inside jobs remain the most common exploit category by count, though they often cause smaller financial losses than technical hacks. These scams prey on uninformed users and unvetted liquidity pools. As a result, security researchers and analytics firms are urging users to stick with audited projects, verified DEXs, and multichain tools like

that only route assets through known and verified liquidity sources.

Whether May's numbers are an anomaly or the start of a positive trend remains to be seen. Many experts caution that exploiters often work in cycles, with periods of dormancy followed by major coordinated waves. But the recent decline is nonetheless a positive signal. It reflects increased cooperation between analytics firms, whitehat communities, and exchanges who now freeze funds faster and enforce compliance more rigorously.

Education continues to be a major barrier to security adoption. The more users understand things like front-running, reentrancy, and rug mechanics, the more difficult it becomes for malicious actors to succeed. This is why educational hubs like

are so crucial—they help demystify technical concepts and empower users to protect their capital.

Crypto security will always be a game of cat and mouse. But what May 2025 proves is that progress is possible. While hackers continue to evolve, so do the tools and communities working to stop them. DeFi protocols, centralized exchanges, and even DAOs are becoming more proactive with security budgeting and incident disclosure.

That’s not to say the battle is over. New threats—from AI-powered phishing to novel flash loan strategies—are constantly emerging. But the infrastructure supporting protocol safety is stronger than ever. Platforms like Jumper Exchange and analytics tools like Forta, TRM Labs, and Chainalysis are reshaping what it means to defend a decentralized network.