Crypto scammers made away with about $244 million in the month of May, a new PeckShield report has shown. According to the report, the stolen amount dropped drastically from April stats, with the largest incident making up 90% of the month’s total.
According to a post by PeckShield on X, the blockchain security firm mentioned that the crypto industry recorded about 20 hacks, pushing the total amount lost to $244.1 million.
“In May 2025, ~20 major crypto hacks were recorded, resulting in total losses of $244.1M — a 39.29% decrease from April,” PeckShied said. The decline comes as the crypto industry has been putting measures in place and stepping up efforts to combat these activities.
Funds from the Cetus DEX hack frozen
According to the blockchain security firm, the biggest hack that occurred last month happened on the Cetus decentralized exchange. The platform suffered a breach on May 22, resulting in the loss of about $223 million in users’ funds.
The incident was reported by pseudonymous Web3 researcher COMDARE3, who posted on X that the Sui-based DEX Cetus is being exploited. According to blockchain security firm Dedaub, the hackers exploited a flaw in the most significant bits (MBS) check.
#PeckShieldAlert In May 2025, ~20 major crypto hacks were recorded, resulting in total losses of $244.1M—a 39.29% decrease from April. Notably, @CetusProtocol & #SUI have frozen a combined $157M of stolen funds (representing 71% recovery from the $220M theft). #Top 5 Hacks in… pic.twitter.com/ZJmGZvbthS
— PeckShieldAlert (@PeckShieldAlert) June 1, 2025
The firm mentioned that the exploit allowed the threat actors to manipulate values for the liquidity parameters by orders of magnitude. It then allowed them to establish relatively large positions with a keystroke.
“This allowed them to add massive liquidity positions with just one unit of token input, subsequently draining pools collectively containing hundreds of millions of dollars worth of tokens,” the blockchain security firm said in its report.
PeckShield added that Cetus and the Sui Network had frozen about $157 million in stolen funds, which represents about 71% of the entire cache.
PeckShield noted that the second-largest exploit of May was the attack on the decentralized finance platform Cork Protocol. According to cybersecurity firm Cyvers, the Cork Protocol hacker used the exploit to cart away about 3,761 Wrapped States Ether (wstETH), which they converted to Ethereum.
Some of the top five hacks for the month included a MBU token exploit worth $2.2 million and an attack suspected to be linked to the DPRK, worth $5.2 million.
Industry steps up the war against crypto hackers
The PeckShield report comes after increased efforts by the crypto industry to protect itself against bad actors. According to previous reports, the security team of crypto exchange BitMEX released a report where it mentioned that it discovered gaps in the operational security of the Lazarus group, a North Korean cybercrime group that is alleged to have ties to the government of the country.
During the counter operations probe into the organization, the platform discovered IP addresses, a database, and tracking algorithms deployed by the group.
According to some of the security researchers, there is a likelihood that one of the hackers in the group accidentally revealed his true IP address, which they said showed the actual location of the hacker to be in Jiaxing, China. The researchers also said they were also able to access a Supabase database, a platform for easily deploying databases with simple interfaces for applications, used by the hacking group.
According to PeckShield, the crypto industry lost over $1.63 billion to hackers, with the blockchain security platform pointing out that the Bybit exploit accounted for more than 92% of the entire loss. The firm also pointed out that over $487 million in crypto was lost to hackers in January, while February saw a jump to $1.53 billion due to the Bybit incident, which has been dubbed the largest crypto heist to date.
UPDATE: An earlier version of this post included information about MapleStory Universe. It has been identified as arbitrage-driven by a MEV and not a hack.
The smartest crypto minds already read our newsletter. Want in? Join them.
