May hack losses improved sharply, but April still matters
May's security reset is real. Crypto platform attack losses fell to $68.3 million, down from $650 million in April. That kind of drop can help repair sentiment quickly.
But it is not a clean all-clear. April was distorted by a small number of huge exploits. Drift Protocol and KelpDAO drove the bulk of that month's damage. That means part of May's improvement reflects a quieter month, not necessarily a full fix across the ecosystem.
The market is split on what that means. Bulls can point to the fact that May was the third month of 2026 to record losses under $100 million. Bears can counter that lower headline losses do not automatically mean the underlying risk profile has improved in a lasting way.
The market still looks stressed on other risk signals
Better hack stats matter only if trading conditions also stabilize. Right now, that relief still looks incomplete. Nearly $930 million in crypto liquidations hit after Bitcoin dropped to a six-week low, which suggests leverage was still being flushed rather than rebuilt.
That is the main reason investors should not overread May's improvement. Even with May hack losses fell to $68.3 million, price action was still driven more by forced deleveraging than by improved security trends.
Why fear can linger after a better security month
There is a structural reason for that caution. Less than 2% of DeFi TVL is insured, so the safety net remains thin even when monthly hack losses cool off. In that sense, May looks more like the start of a reset than a full green light.
Lower hack losses only matter if on-chain activity improves too
A better security backdrop becomes more investable when capital starts moving through these rails again. May's improvement is real, with May attack losses at $68.3 million, but the usage data still points to a cautious market. DEX volume fell to $6.047 billion by May 28 from $22 billion in late January, which argues for wait-and-see rather than breakout language.
What would strengthen the case
The setup gets stronger if activity broadens and holds up: DEX volume stabilizes, usage spreads beyond a handful of dominant venues, and liquidation stress eases. In that scenario, May's security improvement would look less like a one-month relief move and more like part of a healthier pattern.
What would weaken it
The case weakens if trading stays thin and concentration remains high. Lower hack losses alone are not enough if the market keeps showing the same fragility in flows and activity that defined the spring reset.
The read remains constructive but cautious: May improved the security headline, but the market still needs cleaner confirmation across leverage, usage, and breadth before that improvement is fully priced in.