Notifications
Clear all
Topic starter
18/08/2026 2:18 pm
TL;DR: May 2026 saw $59.52M lost across 29 crypto incidents, with bridge validation failures, private key compromise and access control breakdowns recurring while a self-propagating npm worm spread across 1,000+ malicious package versions, according to Quantstamp. The month reinforces that trust boundaries, not just code quality, remain the decisive control plane for crypto and software supply chains.
NHIMG editorial — based on content published by Quantstamp: May 2026 Security Beat
By the numbers:
- $59.52M was lost across 29 crypto incidents in May 2026.
- The category of access control losses accounted for about $20.6M across 9 incidents.
- Mini Shai-Hulud ultimately spread across more than 1,000 malicious package versions.
Questions worth separating out
Q: What breaks when build pipelines are treated as trusted identities?
A: When build pipelines are treated as trusted identities, attackers can use them to mint, reuse and distribute credentials faster than normal review processes can react.
Q: Why do standing owner roles increase risk in smart contract operations?
A: Standing owner roles increase risk because they preserve privileged paths long after the original operational need has passed.
Q: How do security teams know if secret rotation is actually working?
A: Secret rotation is working only when teams can prove that each credential has an owner, an expiry path, and a tested revocation process.
Practitioner guidance
- Audit standing privilege in release and admin paths Identify every owner role, deploy key and signing credential that can still push code, move funds or change contract state without a fresh approval step.
- Treat build pipelines as NHI estates Inventory GitHub tokens, npm tokens, OIDC federation, cloud access keys, Vault tokens and SSH material used by CI/CD.
- Verify bridge messages against authoritative state Require destination-side validation that checks source chain state, replay conditions and expected token flows before any value transfer is accepted.
What's in the full report
Quantstamp's full May security beat covers the incident-by-incident operational detail this post intentionally leaves for the source:
- Per-incident loss breakdowns for each bridge, access control and key compromise case, useful when validating your own exposure model.
- Technical descriptions of the Verus-Ethereum, THORChain and DxSale failure modes, including how each exploit path unfolded.
- The Mini Shai-Hulud propagation timeline across npm packages and release waves, which helps teams map dependency risk to their own build pipelines.
- Source-linked references to DeFiLlama, TRM Labs, Aikido and Socket for practitioners who need to verify the underlying reporting.
👉 Read Quantstamp's May 2026 Security Beat on crypto losses and npm supply chain abuse →
May security beat: what does this say about access and supply chain risk?
Explore further
18/08/2026 3:10 pm
Standing trust is the month’s defining failure mode. May’s incidents did not rely on one exotic exploit path. They repeatedly succeeded because systems continued to trust keys, owner roles and validated-looking messages after the underlying identity had already become unsafe. For practitioners, the lesson is that lifecycle control, not just authentication strength, determines whether trust remains valid.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, and a quarter encountered multiple attacks, according to the same report.
A question worth separating out:
Q: Who is accountable when a supply chain compromise spreads through trusted credentials?
A: Accountability usually spans release engineering, platform security, and identity governance because the incident crosses multiple trust domains. The practical question is which team owns credential scope, publish rights, and offboarding for automation identities. Frameworks such as NIST CSF and NHI governance models help assign control ownership where a single compromise can affect many systems.
👉 Read our full editorial: May security beat: keys, access control and supply chain abuse
