May 2026 Protocol Engineering Recap

To avoid mixing April postmortems with May incidents, this ledger uses DefiLlama’s hacks database filtered to May 1-31, 2026 as the incident spine, then cross-checks larger, ambiguous, or missing rows against BlockSec, Recoveris, Phemex, Crypto Briefing, Rekt, BeInCrypto, Cryptopolitan, and other incident reports. The DefiLlama rows for May sum to approximately $59.5M in listed losses, TAC, Boost Hook, and Huma Finance are added from the source-confirmed incident reports because they were covered in the May research set but did not appear in the filtered DefiLlama API rows. Some reports quote larger notional exposure for incidents such as Echo Protocol and StablR because attackers minted unbacked assets that could not all be cashed out, those cases are separated below as realized loss versus notional minted supply.

Bisq: The fake-client incident could have been avoided with stronger release-channel integrity: signed and reproducible binaries, in-app update verification, explicit checksum verification in user flows, and rapid takedown monitoring for lookalike distribution paths. For user-facing crypto software, the client binary is part of the custody boundary, if attackers can replace the client, the protocol’s on-chain guarantees no longer protect the user.

Sharwa.Finance: The oracle-price manipulation row points to the usual thin-liquidity problem: a protocol trusted a price that could be moved faster than the protocol could defend. This class is avoidable with TWAPs or medianized oracle sources, liquidity-depth checks, per-block price-change caps, and tests that simulate flash-loan scale trades against the exact markets used for valuation.

SmartCredit: Flash-loan exploits are usually symptoms of state accounting that assumes capital is sticky inside one transaction. The prevention pattern is to snapshot balances before sensitive actions, use debt/share invariants rather than raw spot balances, add same-block manipulation tests, and reject state transitions that only work because borrowed liquidity appears for a single call path.

Ekubo: Phemex and Recoveris describe a custom router/extension path where payment callback authorization failed to prove that the payer was the lock initiator or an authorized payer. This could have been avoided by binding callbacks to a nonce-scoped lock context, checking payer authority inside the extension contract, minimizing long-lived ERC-20 allowances, and shipping router upgrades with approval-revocation guidance before activation.

TrustedVolumes: BlockSec’s analysis describes an RFQ authorization mismatch where the signer permission check and the transfer source referred to different order fields. The avoidable invariant is simple and strict: the signer, maker, transfer source, token owner, and replay domain must be bound in the same signed object, with tests that intentionally permute those fields and prove settlement reverts.

Renegade: The Renegade loss came from a deployment-level mistake: an initializer or owner path that stayed open on a legacy Arbitrum dark-pool proxy. This could have been prevented with deployment scripts that initialize and lock proxies atomically, automated scanners for uninitialized implementations, explicit owner assignment checks, and a post-deploy invariant that no public caller can rewrite implementation or resolver logic.

INK Finance: INK Finance was drained after whitelist or claimer logic let an attacker impersonate an authorized claimant. The fix is not only adding onlyRole to one function, the safer design is a canonical allowlist root or signed claim scheme, role-gated list mutation, per-drop amount caps, and negative tests showing that arbitrary contracts cannot register themselves for treasury claims.

Huma Finance: Huma Finance disclosed that deprecated V1 BaseCreditPool contracts on Polygon were exploited through a credit-lifecycle logic flaw, while user deposits and the newer Solana V2 system were unaffected. This should have been avoided by fully sunsetting legacy pools, removing residual fees from old contracts, adding access-control tests around drawdown state transitions, and treating deprecated deployments as active risk until every balance and approval is drained or revoked.

Aurellion: DefiLlama classifies Aurellion as an uninitialized proxy exploit, the same avoidable deployment class as many upgradeable-contract takeovers. Teams can prevent it by disabling initializers on implementations, initializing proxies in the same transaction that deploys them, monitoring for Initialized events, and treating any externally callable initializer on production contracts as a release blocker.

SQ Protocol: The SQ Protocol entry is an access-control exploit, which means the core failure was an unauthorized actor reaching a privileged state transition. The practical prevention path is complete role mapping, tests for every privileged function from a non-privileged caller, explicit admin-transfer workflows, and monitoring that alerts when sensitive functions are invoked outside expected operational windows.

TAC: TAC’s bridge accepted TON-side jetton deposit notifications without verifying that the sender was the canonical token wallet derived from the official jetton master. This could have been avoided by deriving the expected wallet address on-chain or in a verified bridge module, binding asset identity to the source wallet, rejecting non-canonical notification senders, and testing fake-deposit messages before cross-chain minting went live.

Transit Finance: BlockSec and Web3 is Going Great describe a legacy TRON swap-bridge contract that could still move funds from users who had never revoked approvals. This should have been avoided by fully decommissioning deprecated contracts, revoking or invalidating old approval paths where possible, enforcing target-and-selector allowlists on forwarding logic, and maintaining a public retirement checklist for every obsolete contract.

Boost Hook: Boost Hook was exploited through direct use of Uniswap V4 slot0 spot price as an entry reference for leveraged positions. This could have been avoided by using a TWAP or another manipulation-resistant price reference, enforcing price-deviation limits around position entry, and testing the hook against flash-loan-driven pool manipulation before allowing repeated leveraged opens.

Thorchain DEX: The THORChain incident was reported as a vault-churn or TSS-adjacent validation failure rather than a simple Solidity bug. Avoidance here means treating validator churn, vault address derivation, and threshold-signature membership as consensus-critical surfaces: require independent verification of new vault addresses, delay high-value outbound flows after churn, and run anomaly detectors that can pause signing before funds leave multiple chains.

Adshares: The Adshares bridge-verification bypass belongs to the same family as many cross-chain failures: destination-chain release logic accepted a message without enough source-chain proof. Prevention requires binding source chain, source amount, token identity, recipient, nonce, and finality proof into one verified message, then testing forged, replayed, partial, and type-confused bridge messages before mainnet liquidity is connected.

SEA Token: SEA Token’s flash-loan price manipulation could have been avoided by refusing to use a manipulable same-block AMM spot price for sensitive accounting. Protocols should prefer time-weighted or externally aggregated price feeds, enforce minimum liquidity and maximum price-impact bounds, and fuzz liquidation, mint, burn, and reward paths under adversarial reserve changes.

Verus-Ethereum Bridge: BlockSec and Recoveris both frame Verus as a bridge validation failure where destination-side value release was not tightly matched to the source-side event. This class is avoidable with source-destination value equality checks, strict message-type validation, multi-client proof verification, conservative rate limits, and emergency pause automation for any bridge message that releases assets without a matching burn or lock.

Echo Bridge / Echo Protocol: Echo’s headline looked like a ~$76.6M unauthorized eBTC mint, but several sources note that the realized extraction was closer to ~$816K because the attacker could not cash out the full fake supply. The root prevention is privileged mint hardening: no single admin key should grant mint authority, mint roles should sit behind multisig or MPC plus timelock, supply caps should halt impossible issuance, and bridge deployments should have isolated pause controls per chain.

Bankr: DefiLlama classifies Bankr as a compromised-session-key incident. Session keys should be treated as hot-wallet credentials with blast-radius limits: scoped permissions, short expirations, per-session spend caps, user-visible revocation, device binding, and server-side anomaly detection for actions that exceed normal agent or wallet behavior.

HermesVault: HermesVault’s Algorand rekeying attack highlights an account-model edge case that EVM-centric audits often miss. Avoidance requires explicit checks on authorized addresses after rekeying, transaction-group simulations that include malicious rekey operations, and wallet/protocol UX that warns users before they delegate signing authority in ways that let an attacker move assets later.

MAP Protocol: Infinite-mint-and-dump attacks are preventable with supply invariants that are enforced both in code and tests. Any mint path should have a clear authority, a cap or backing check, event monitoring, and a property test that total supply cannot increase without the corresponding locked asset, burned asset, governance action, or verified cross-chain message.

RetoSwap: BlockSec describes RetoSwap as a P2P-flow authentication failure where a forged ACK message let the attacker hijack the arbitrator role. This could have been avoided by signing every state transition with the expected participant keys, binding ACK messages to session IDs and nonces, rejecting role changes after trade initialization, and testing network-level message ordering and frontrun scenarios.

Polymarket: DefiLlama and BlockSec classify the Polymarket incident as a private-key compromise. The prevention playbook is operational rather than exotic: HSM or MPC custody for privileged keys, least-privilege contract roles, delayed withdrawals from admin-controlled addresses, key rotation drills, and alerts on new signer activity or unexpected high-value transfers.

Mure: Mure’s access-control exploit is the small-dollar version of a large-dollar pattern. Teams can avoid it by building an authorization matrix before deployment, requiring tests for unauthorized callers on every mutating function, avoiding default-open admin paths, and running static analyzers that flag public or external functions touching privileged state.

StablR: StablR reports are easiest to misread: external reporting describes roughly $13.5M in unbacked stablecoins minted, while DefiLlama lists a lower realized loss around $2.8M. The avoidable failure was issuer-control fragility: stablecoin minting should require a real multisig threshold, separation between mint and upgrade authority, per-epoch mint caps, real-time backing checks, and an emergency freeze process that is rehearsed before assets trade broadly.

Fractal Protocol: Fractal Protocol’s flash-loan price manipulation is avoidable with the same market-design discipline as SEA Token: do not let one-block liquidity define collateral, rewards, or redemption value. Add TWAPs, liquidity floors, oracle deviation checks, and tests that combine flash loans with the exact user flows that move value out of the protocol.

New Market Trading: Rekt’s writeup describes funds drained from many Gnosis Safes through a third-party module, which is a reminder that Safe modules are effectively wallet-level code execution permissions. This could have been avoided by auditing every enabled module, setting module allowlists and expiration dates, revoking stale module permissions, and requiring clients to approve module changes with the same seriousness as signer changes.

WUSD.fi/Glove: A Sybil-abuse loss usually means an incentive or claim system treated many attacker-controlled identities as independent users. Avoidance requires rate limits, stake or time-weighted eligibility, anti-Sybil scoring, per-entity reward caps, and pre-launch simulations where one actor controls thousands of wallets and tries to maximize extraction.

Stake DAO: DefiLlama classifies Stake DAO as a private-key compromise, which is almost always a process failure as much as a cryptographic one. Teams should use MPC or hardware-backed signing for treasury and strategy keys, enforce role-scoped keys instead of god-mode operators, monitor signing hosts, and maintain an incident runbook for immediate revocation and contract pausing.

DxSale: DxSale’s late-May exploit reportedly hit old BNB Chain liquidity lockers through an ownership override or hidden-backdoor pattern. The avoidable lesson is that legacy lockers must be verifiably immutable or explicitly sunset: ownership should be renounced or timelocked, code should be verified, backdoor-capable functions should not exist, and abandoned pools should have a migration path before old contracts become forgotten honeypots.

Alephium Bridge: Alephium’s TokenBridge was drained after forged bridge messages passed guardian validation, with reports pointing to compromised guardian keys and 13.76M unbacked wrapped ALPH minted. This could have been avoided with stronger guardian independence, hardware-backed key custody, threshold designs that do not concentrate compromise risk, per-message rate limits, and bridge monitors that halt minting when wrapped supply diverges from locked backing.

Gravity Bridge: Gravity Bridge was drained through what several reports describe as a bridge signing-key compromise rather than a contract-code bug. Prevention means validators and orchestrators need hardened signing environments, key rotation and compromise drills, transfer limits, independent co-signing checks, and automatic halts when signer behavior deviates from normal bridge flow.

Decision-ready insight: May’s Web3 hacks were not one category of bug. They clustered around five repeated control failures: bridge-message validation, privileged-key custody, legacy-contract decommissioning, proxy/initializer hygiene, and manipulable price or identity assumptions. A May-ready security program would turn those five controls into CI tests, deployment gates, monitoring rules, and incident drills.