Over $28M was drained across five incidents between May 11 and May 17, 2026: an $11.6M drain on the Verus-Ethereum bridge that consolidated everything into a single ETH wallet, a threshold signature scheme compromise on THORChain, a credential-stealing supply chain attack against the node-ipc npm package, an exploit of a deprecated Transit Finance contract on TRON, and a memecoin pump-and-dump executed through a takeover of Keith Gill’s Roaring Kitty X account.
This week’s Recoveris report covers the Verus-Ethereum bridge exploit that drained 103.6 tBTC, 1,625 ETH, and 147,000 USDC into a single attacker wallet holding 5,402 ETH, the THORChain GG20 TSS exploit that drained $10.7M across BTC, ETH, BNB, and Base, the node-ipc supply chain compromise targeting developer credentials and .env files, the $1.88M Transit Finance drain via a 2022-era contract on TRON, and the $2.86M Roaring Kitty account takeover that pumped a Solana memecoin to $12M market cap before collapsing.
Verus-Ethereum Bridge – ~$11.6M | May 17–18, 2026 | Cross-Chain Bridge Exploit
The Verus-Ethereum bridge was drained of 103.6 tBTC, 1,625 ETH, and 147,000 USDC late on May 17 into the early hours of May 18, according to The Block and Blockaid’s initial flag. The attacker, identified at 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9, swapped all stolen assets into 5,402 ETH (~$11.4M at the time) and consolidated them in a single wallet. Initial funding for the attacker wallet was traced back to Tornado Cash. The Verus team pushed emergency update v1.2.14-2 and paused affected components.
The attack vector is described by independent analysts as an economic validation gap in the bridge’s cross-chain transfer verification, in the same TTP family as Wormhole and Nomad. Bridge architectures that mint or release tokens on one chain based on attested deposits on another require every link in the validation chain to enforce identical economic guarantees. A gap at any single layer collapses the entire trust model. Verus has not published a full post-mortem at time of writing, so the precise primitive that failed is not yet confirmed.
Funds consolidated in a single ETH wallet less than 24 hours after the drain is the highest-leverage moment for a recovery effort. Coordinated freezing requests to centralized exchanges, stablecoin issuers, and major liquidity venues, plus on-chain tracing of any subsequent splits, are the standard first moves. The attacker’s pre-attack funding via Tornado Cash limits attribution upstream, but every onward movement is now a new forensic surface.
Sources: The Block, Coinfomania, blockchain.news flash
THORChain – ~$10.7M | May 15, 2026 | Infrastructure / Validator Compromise
THORChain was drained of approximately $10.7M across Bitcoin, Ethereum, BNB Chain, and Base on May 15, 2026, according to CoinDesk and The Record. Attacker-linked wallets accumulated roughly 3,443 ETH, 36.85 BTC, and 96.6 BNB. The protocol’s automated monitoring detected abnormal outbound activity and froze all swaps, signing, and sensitive operations for roughly 13 hours while contributors investigated. RUNE fell about 12%.
The leading hypothesis points to a vulnerability in the protocol’s GG20 threshold signature scheme. A newly churned validator node, identified by THORChain contributors as thor16ucjv3v695mq283me7esh0wdhajjalengcn84q, joined the active set several days before the exploit and is believed to have leaked sensitive key material via “vault churn address poisoning” during routine migration. With enough fragments exposed, the attacker could reconstruct a vault private key and authorize unauthorized outbound transactions. Chainalysis subsequently traced the attacker’s funding path through a Hyperliquid-Monero privacy bridge, with XMR deposits feeding ETH bonded to RUNE for that validator node.
TSS-based custody is widely treated as a hardened alternative to single-signer designs, and a documented failure in a production deployment recalibrates assumptions across cross-chain bridges, MPC wallets, and validator-set custody schemes. THORChain confirmed no user funds were lost and that the loss landed on protocol-owned reserves. A refund portal was launched with treasury-backed claims available until June 4. The pre-attack on-chain trail through known privacy infrastructure leaves an exploitable forensic surface for off-ramp interception at downstream venues.
Sources: CoinDesk, The Record, Bitcoin.com News, AMBCrypto, Chainalysis trace coverage
node-ipc npm Package – Undisclosed aggregate loss | May 14, 2026 | Supply Chain Attack
Three malicious versions of node-ipc, a Node.js inter-process communication library with over 10 million weekly downloads, were published to the npm registry on May 14, 2026, according to The Hacker News and StepSecurity. Versions 9.1.6, 9.2.3, and 12.0.1 each contained an identical 80 KB obfuscated credential-stealing payload injected into the package’s CommonJS bundle. SlowMist reported approximately 822,000 downloads were at risk before the malicious versions were caught and unpublished.
The maintainer takeover followed a textbook expired-domain pattern. The dormant maintainer’s email domain expired on January 10, 2025 and was re-registered by the attacker on May 7, 2026, one week before the malicious publish. Control of that domain alone allowed the attacker to inherit the npm maintainer identity through the legitimate password recovery workflow. The payload fingerprints the host environment and harvests roughly 90 categories of credentials: AWS, GCP, Azure keys, SSH keys, Kubernetes tokens, GitHub CLI configs, Terraform state, shell history, and crucially for crypto operators, .env files that typically store private keys, RPC node credentials, and exchange API secrets. Exfiltration runs over DNS tunneling to a remote endpoint.
Supply chain attacks on widely-used development packages create a fan-out forensic problem instead of a single recovery target. Every team that pulled a poisoned version into a build pipeline between publish time and detection is a potential source of leaked secrets, and stolen credentials can sit dormant for weeks before being weaponized. The first response is credential rotation and audit of any npm publish tokens accessible from compromised machines. The more durable concern is downstream: stolen exchange API keys and private keys may surface in unrelated incidents later in the year, requiring attribution back to this attack window.
Sources: The Hacker News, StepSecurity, SlowMist via news.bitcoin.com, BleepingComputer
Transit Finance – ~$1.88M | May 12–13, 2026 | Smart Contract / Deprecated Contract
Transit Finance, a cross-chain DeFi protocol, was drained of approximately $1.88M in DAI, according to PeckShield’s flag on May 13. The stolen funds landed at a single Ethereum address (0x8a634DfA2609358849D7D65FFA270C8A57a8abA5) and remained unmoved as of disclosure. The exploit targeted a Transit Finance smart contract deployed on TRON in earlier years that was officially deprecated in 2022 but never decommissioned on-chain.
Deprecated contracts that remain deployed and approved are a recurring failure mode in long-lived protocols. Users who granted token approvals years earlier may still have active allowances against the deprecated contract, turning every previously approved wallet into a draining vector once a vulnerability surfaces. This is the second material incident in Transit Finance’s history. The project lost between $21M and $29M in October 2022 through a composability flaw in its swap contract that permitted unauthorized arbitrary external calls.
Transit Finance pledged to compensate all affected users and sent an on-chain message to the attacker offering a bug bounty in exchange for return of the assets, with a 48-hour window. Funds sitting consolidated at a single Ethereum address creates a narrow window for freezing requests at centralized off-ramps and stablecoin issuers before the attacker layers through bridges or mixers. Parallel forensic tracing in tandem with negotiation is the standard playbook when an exploiter has not yet committed to laundering.
Sources: The Crypto Times, crypto.news, Crypto Briefing, NullTX
Roaring Kitty / RKC Memecoin – ~$2.86M | May 11, 2026 | Account Takeover / Memecoin Drain
Keith Gill’s verified X account, dormant for 16 months under the Roaring Kitty handle, posted a Solana memecoin contract address and a short cartoon clip on May 11, 2026. The token, Red Kitten Crew (RKC), launched on Pump.fun and pumped to a roughly $12M market cap within an hour, according to Lookonchain’s on-chain analysis. The posts were then deleted, the token collapsed by more than 80%, and over 80 wallets extracted a combined $2.86M during the rally. The RKC developer pre-loaded 10 wallets with 20 SOL (~$1,950 in total) to acquire 39.52% of the token supply before the public posts appeared, then cashed out 6,260 SOL (~$611K).
Account-takeover memecoin pumps weaponize the audience of trusted creators instead of any on-chain vulnerability. The forensic signal is concentrated entirely off-chain (X access logs, IP attribution, possible SIM-swap or session token theft) and on-chain in the pre-loaded developer wallets and the timing of buy transactions relative to the post. Pre-funded buy-side wallets created seconds before the post is a near-perfect indicator of coordinated insider activity. GameStop stock briefly spiked 13% on the news before erasing gains, and Gill has not publicly confirmed whether the account was compromised.
For affected wallets, on-chain forensic tracing can identify and cluster the developer’s buy-side wallets, the dump path through Pump.fun and downstream DEXs, and any subsequent off-ramps. Each cluster is a discrete recovery target when funds reach centralized exchanges or stablecoin venues. Coordinated freezing requests across the relevant Solana liquidity venues and CEX hot-wallet deposit addresses are the practical first move once attribution is established.
Sources: crypto.news, TradingView (Invezz), Coinpedia, Cryip
Post-Incident Developments | Prior Weeks
Three prior-week incidents saw material in-window movement on enforcement, recovery, and successor-scheme attribution.
The BG Wealth / DSJ Exchange Ponzi ($150M+ exposure, collapse window April 27 – May 3) continued to surface fresh material this week. Tether had previously frozen $38.4M in USDT on TRON across 19 addresses and exchange partners froze another $3.1M, bringing total recovered funds to $41.5M (out of $92M moved through cross-chain bridges during the laundering window). On May 16, The Crypto Times published an investigation flagging Swift Wave Capital and HQI Exchange as suspected successor pipelines, with operators migrating victims onto renamed platforms using the same daily-return structure (1.3–2.6%) and tiered referral model that drove BG Wealth’s growth. The FBI had seized the primary BG Wealth domain on April 23. Operators leveraged the remaining access window to extract additional funds through a 12% “exit tax” levied via a fabricated “Stephen Beard” CEO persona. Thirteen regulators across five continents had issued warnings before collapse.
The Kelp DAO / LayerZero $292M exploit (April 18, 2026) resumed normal operations this week. Kelp DAO restarted withdrawals, bridging, and protocol functions on May 14–15 after a security overhaul. Aave maintained the rsETH market freeze as containment, and net outflows from rsETH continued (~$936K in net outflows one month post-hack). Chainalysis attribution to North Korea’s Lazarus Group via the DDoS-forced RPC node poisoning and forged LayerZero bridge message remains the standing technical narrative.
The three Tennessee men accused of a violent crypto-robbery spree across the Bay Area and Los Angeles (Elijah Armstrong, Nino Chindavanh, Jayden Rucker) were indicted by a federal grand jury in the Northern District of California with Hobbs Act robbery conspiracy, kidnapping conspiracy, and attempted versions of both. Court appearances ran on May 12 for Armstrong and Rucker (Chindavanh’s hearing is set for June 26). The indictment covers a string of November–December 2025 home invasions in San Francisco, San Jose, Sunnyvale, and Los Angeles, where suspects posed as delivery workers, restrained victims with duct tape and zip ties, and forced cryptocurrency transfers totaling approximately $6.5M. Kidnapping conspiracy carries a potential life sentence.
Sources: The Crypto Times – BG Wealth / DSJ pipeline, The Crypto Times – DSJ $41.5M freeze, AMBCrypto – DSJ $92M laundering, Chainalysis – KelpDAO bridge exploit, DOJ – Tennessee indictment, CBS News – California crypto robbery spree
If your platform or users have been affected by recent exploits, immediate forensic intervention is critical to tracing and freezing assets before they reach obfuscation services.
