Crypto Bridge Exploits Hit $328.6M in May as Peckshield Tracks 8 Major Incidents

"Peckshield released a mid-May tally of eight bridge-related exploits that collectively drained $328.6 million from cross-chain protocols so far this year. The figure adds to what has become the worst period on record for decentralized finance (DeFi) while simultaneously exposing a systemic vulnerability that the industry has yet to resolve fully. Eight major exploits that have already happened through the first half of May, per Peckshield."

"Cross-chain bridges work by locking tokens on one blockchain and minting equivalent assets on another, creating high-value attack surfaces where exploiters need only compromise the bridge's verification mechanism to gain access to pooled liquidity. The structural risk became undeniable in April 2026, as crypto's most-hacked month on record, with 30 separate incidents, a pace of nearly one attack per day."

"KelpDAO's Layerzero V2 rsETH route was exploited for approximately $300 million on April 18, with an attacker extracting 116,500 rsETH from Ethereum's OFT adapter without burning tokens on the source chain. A review by Chainalysis found that Layerzero had set a low 1-1 RPC quorum default, meaning a single poisoned node could authorize fraudulent cross-chain messages. KelpDAO subsequently migrated to Chainlink's Cross-Chain Token standard, publicly blaming Layerzero for the infrastructure failure."

"Days later, Drift Protocol suffered a $200 million-plus exploit on its Solana-based infrastructure. A CertiK analyst noted that the incidents reflecte... Total 2026 hack losses surpassed $750M through mid-April; May's Verus bridge drain adds $11.5M more. Crypto's Worst Year for Cross-Chain Hacks Blockchain security and data analytics firm Peckshield released a mid-May tally of eight bridge-related exploits."

Peckshield tracked eight bridge-related exploits through mid-May 2026, totaling $328.6M drained from cross-chain protocols. Cross-chain bridges lock tokens on one blockchain and mint equivalent assets on another, creating attack surfaces where compromising bridge verification can unlock pooled liquidity. April 2026 became the worst-hacked month on record, with 30 incidents and nearly one attack per day. KelpDAO’s Layerzero V2 rsETH route was exploited for about $300M on April 18, involving extraction of 116,500 rsETH from an Ethereum OFT adapter without burning tokens on the source chain. Chainalysis linked the issue to a low 1-1 RPC quorum default that could allow a single poisoned node to authorize fraudulent messages. Drift Protocol later suffered a $200M+ exploit on Solana infrastructure, and Verus added an $11.5M bridge drain in May, bringing 2026 losses above $750M through mid-April.

Read at news.bitcoin.com