A dicey weekend for DeFi hacks has seen a total of $7 million lost across four separate incidents.
Disruption on Sui network continued through the back end of last week, ultimately extending to three incidents, and early this week, popular Euro crypto card Gnosis Pay warned users to withdraw their funds.
The hacks
Despite being first to occur, Fluid only disclosed a compromise of its “rewards distribution infrastructure” on Sunday, four days later.
The announcement came after X account YieldsAndMore drew attention to the loss of 125,000 FLUID (worth approximately $200,000 at the time) and 52,000 of the GHO stablecoin on May 27.
Fluid was criticized on X for delaying the announcement of the $250,000 loss, and instead encouraging users to take advantage of high yields following a $77 million withdrawal.
The exploit was on May 27th.
A lender withdrew $77m of $USDC starting on the 28th.
The team posted about high deposit rates for $USDC on the 28th.
This exploit was surfaced earlier today (May 31st) and only after that was it disclosed.
Why was it only disclosed now?
— jpn memelord🛡️ (@jpn_memelord) May 31, 2026
There were also two bridge hacks over the weekend, affecting the Gravity and Alephium bridges.
Alephium’s $815,000 loss was first spotted by Blockaid on Saturday. The firm later walked back its initial theory that “compromised guardian keys” caused the loss, after the Alephium team’s post.
Also on Saturday, the Gravity bridge X account warned of an “unfortunate incident,” instructing validators to halt operations. Hours earlier, on-chain investigator SpecterAnalyst had flagged the theft of $5.4 million worth of $USDC, WETH, USDT and PAXG.
At least 10 bridge hacks have rocked the crypto sector so far this year.
Finally, yield vault platform Artificial Financial Intelligence announced a “security incident” in its afiUSD Vault.
While the team’s alert didn’t specify the amount lost, a quick look at the vault’s transaction history reveals a withdrawal of approximately $500,000 of various DeFi tokens. The vault’s dashboard displays a TVL of almost $400,000, but its portfolio section lists just $300 worth of tokens.
In a follow-up post on Monday, the team confirmed that around $480,000 was lost to a “sophisticated exploit,” with a full post-mortem to come.
The downtime
On Thursday last week, Sui Network went down in its third outage of the year so far.
Three being the magic number, the downtime turned out to itself be just the first of three disruptions over the following 48 hours.
Sui’s status page shows disruption of almost six hours on Thursday, and two outages of eight and a half hours and 45 minutes on Friday.
A blog post published by the Sui Foundation on Sunday explained that the first two incidents were linked to a recent update. The third was caused by a rushed fix, which the foundation described as an “interim measure designed to restore functionality [which] had a known issue with a low probability of causing a halt.”
The warning
After such a volatile weekend, there’s nothing quite like a vague but urgent warning to kick off the week.
On Monday morning, Gnosis’ Martin Koeppelmann warned users of the Gnosis Pay crypto card to withdraw their funds. It was later deleted, with Koeppelmann later clarifying “most users will not be able to do so.”
Deleted an earlier tweet that asked users to withdraw funds. Most users will not be able to do so, but we are actively working to contain the damage. We believe we can contain the majority of it, and in any case, we will ensure that all users are made whole.
— koeppelmann (@koeppelmann) June 1, 2026
The danger apparently lies in the “Zodiac delay module” and allows a hacker to initiate transactions from users’ Safe accounts. Koeppelmann reassured users that, if affected, they would be reimbursed.
May DeFi hack roundup
There appears to be no let-up in the recent string of crypto exploits which began to turn heads in April; over $60 million was lost in May.
Losses are down from April, which was dominated by losses of $280 million from Drift Protocol and $290 million from Kelp DAO/LayerZero. However, the number of significant incidents listed on Protos’ hack tracker is similar; 30 in May versus April’s 33.
