TRM Labs data published in May 2026 says North Korea was linked to $577 million of the $651 million lost to crypto hacks in January–April 2026, or 76% of the total. The losses were concentrated in two April incidents attributed to Lazarus subgroup TraderTraitor: $285 million from Drift Protocol on April 1 and $292 million from Kelp DAO on April 18–19.

Intesa Sanpaolo disclosed that its crypto-related holdings rose from about $100M in Q4 2025 to roughly $235M in Q1 2026, including Bitcoin ETFs and new exposure to Ethereum and XRP. The filing also shows a new $95.9M call option tied to BlackRock’s IBIT, alongside increased positions in ARK 21Shares Bitcoin ETF and IBIT shares. The positions are described as proprietary trading on the bank’s own balance sheet, not a client product.

U.S. spot Bitcoin ETFs saw $1.8B in net redemptions over six trading days in May 2026, including a $648.64 million outflow on May 18 led by BlackRock’s IBIT at $448 million. Total net assets slipped below $100.49 billion as inflation data and U.S. legislative developments weighed on risk appetite.

A cluster of three DeFi exploits in May 2026 caused reported losses of $23.2 million across THORChain, Verus-Ethereum Bridge, and Echo Protocol. The incidents were dated May 15 ($10.8M), May 18 ($11.58M), and May 18-19 ($816K), with Echo's attacker also minting 1,000 eBTC at a nominal $76.7M that could not be fully realized due to limited liquidity.

As of May 12, 2026, 174 publicly listed companies held 1,187,898 BTC, accounting for over 5% of Bitcoin’s total supply. In Q1 2026, corporate treasuries added a net +50,351 BTC, a buying pace described as 2.8x daily global mining output.

Euro-denominated stablecoins expanded from $69 million to $777 million in monthly volume between January 2025 and March 2026. The increase was reported in TRM Labs’ Q1 2026 Global Crypto Adoption Index, published on April 23, as MiCA implementation advances and bank-led consortium Qivalis targets a euro stablecoin launch in the second half of 2026.

Ethereum's Clear Signing standard is scheduled to launch on May 12, 2026, aiming to replace opaque hex prompts with readable transaction summaries before users approve actions. The initiative is based on ERC-7730 and ERC-8176, with Ledger, Trezor, MetaMask, and Fireblocks among the early participants.

Google’s Threat Intelligence Group (GTIG) said on May 11, 2026 it documented what it calls the first AI-developed zero-day: a two-factor authentication bypass in a widely used open-source web administration tool. Google said it coordinated with the vendor to patch the issue before a broader exploitation campaign began. GTIG also described a wider rise in AI-assisted activity across state-linked and criminal groups, including risks to AI tooling dependencies used in crypto systems.

On May 6, 2026, Ondo Finance, JPMorgan's Kinexys, Mastercard and Ripple completed a live cross-border redemption of tokenized U.S. Treasuries on the XRP Ledger, with the on-chain token leg finalized in under 5 seconds. The fiat leg was routed via Mastercard's Multi-Token Network and JPMorgan's correspondent banking rails to Ripple's Singapore bank account, and the flow was executed outside banking hours.