A run of $10 million to $36 million bridge and key thefts
June, 2026 (May to June 2026)
After the April thefts came a series of mid-sized ones. THORChain lost about $10.7 million on May 15 when a malicious node operator abused a flaw in its threshold-signature scheme. The Verus Ethereum bridge lost about $11.6 million on May 18 because of a missing check that let a forged proof pass. The Syscoin bridge lost about $10 million on June 7 after a parsing error in proof validation allowed unauthorized tokens to be minted. On June 8, Humanity Protocol lost about $31 million to $36 million after malware on a developer's laptop exposed seven private keys. Amounts vary by tracker.
Why it matters
Two of the four were plain verification mistakes in bridges, and one was a stolen-keys problem on a single laptop. Individually small, together they show the same weak spots again and again.
What defenders can take from it
- Keep signing keys off everyday developer machines and use hardware-backed storage.
- Have bridge proof-validation code reviewed independently, including edge cases in parsing.