Hackers hijacked the X accounts of SpaceX and Starlink to promote a fake meme coin, making about $135,000. The token briefly topped a $2 million market value before crashing after a rug pull.

Bonzo Lend lost $9.05 million after attackers manipulated a faulty oracle price feed to inflate SAUCE token prices. The flaw was traced to Supra's oracle verifier, prompting the lending platform to suspend its lending services.

Japanese police arrested a 15-year-old student accused of using ChatGPT-assisted code to launch a cyberattack that cancelled 46,812 Bandai Channel subscriptions. The teenager allegedly exploited a system vulnerability, changed his IP address multiple times to evade security measures, and accessed user account information.

Hackers stole nearly $3 million from around 11 Polymarket users after compromising a third-party service and injecting malicious code into the platform's website. Polymarket said its core systems were not breached and has started refunding affected users in full.

Taiko’s bridge system had a security flaw that let attackers trick Ethereum into accepting fake messages as real. This allowed unauthorised withdrawals from token vaults, leading to around $1.7 million in losses and a full pause of the network’s bridge and block production.

Hackers exploited a flaw in Meta’s AI support assistant to take over Instagram accounts by changing recovery email addresses and resetting passwords without access to victims’ emails. Several high-profile accounts were affected before Meta fixed the issue and began securing impacted users.

GitHub said attackers accessed its internal repositories after an employee’s device was compromised through a malicious VS Code extension. The company says customer data appears unaffected, but thousands of internal repos may have been exposed and the investigation is ongoing.

A fake OpenAI repository on Hugging Face spread malware that stole crypto wallets, browser data, and developer credentials from Windows users. The fake project briefly became the platform’s top trending repo and reportedly reached around 244,000 downloads before it was removed.

A crypto trader known as Unihax0r lost over $200,000 after two of his wallets were drained across Ethereum, Base, and BSC in a fast multi-chain attack on 11 May 2026. Investigators believe the issue came from a private key leak linked to a Telegram trading bot called SIGMA, which may have exposed the wallets to the attacker.

A hacker claimed to have taken over 300,000 Polymarket user records and tried to sell them on the dark web. Polymarket denied any breach, saying the data is already public through its on-chain systems and tools.