May 2026 Is Becoming One of the Worst Months in DeFi Security History

[madmax]

The Echo Protocol exploit is the latest in a growing list of DeFi security incidents in May 2026, bringing the month's total to at least 13 protocols compromised with collective losses already running into the hundreds of millions of dollars. The month has seen THORChain halt trading after a $10 million vault key exploit, the Verus-Ethereum Bridge lose $11.6 million through a fake cross-chain transfer message, and Transit Finance suffer a $1.88 million loss from a deprecated smart contract exploit, among others. Echo Protocol's $76.7 million loss now stands as one of the largest single incidents of the month and adds significant weight to what is shaping up to be a historically damaging period for decentralized finance security.

The broader 2026 picture is equally troubling. Two of the largest DeFi hacks on record occurred this year, with Drift Protocol losing $285 million and Kelp DAO exploited for $292 million in April alone. More than 20 protocols have shuttered services entirely following attacks, and the pattern of incidents is revealing a consistent set of vulnerabilities: admin key compromises, bridge weaknesses, deprecated contract exploits, and infrastructure-level failures that fall outside the scope of traditional smart contract audits. The diversity of attack vectors being successfully exploited suggests that the DeFi industry's current security practices are struggling to keep pace with both the scale of value being secured and the sophistication of the actors targeting it. With May still not over and multiple investigations still ongoing, the final tally for the month is likely to grow further before it stabilizes.

[mendez]

Minted 1,000 eBTC that didn't exist, bridge vulnerability