On May 18, 2026, the UK's Financial Conduct Authority (FCA) and the Bank of England published a joint vision to expand tokenisation and distributed ledger technology across wholesale financial markets, aiming to help the shift from pilot projects to live production use. The plan pairs regulatory work with infrastructure changes, including a consultation on near-24/7 settlement operations and updated prudential guidance covering tokenised exposures and stablecoins.

Adshares said an attacker involved in its bridge incident returned 256 ETH (about $540,700), roughly 86% of the estimated $628,000 taken. The exploit was linked to bridge mint-validation failures, and analysts warned that recovery windows often trigger phishing “refund” sites and impersonator accounts.

Aave reinstated WETH loan-to-value parameters across six V3 deployments on May 18, 2026, after 95.4% of unbacked Kelp DAO rsETH was recovered. The remaining gap is about ~5,200 rsETH, while 30,765 ETH (about $71M) is still frozen on Arbitrum amid a U.S. federal court dispute in Manhattan.

On May 18, the Verus-Ethereum bridge was hit by a coordinated exploit that drained about $11.5 million. The attacker removed 103.6 tBTC, 1,625 ETH, and 147,000 USDC, then swapped the proceeds into roughly 5,402 ETH held at address 0x65Cb25F9. Blockaid said it flagged the incident live and linked the wallet’s initial 1 ETH funding to Tornado Cash.

PeckShield reported that cross-chain bridges suffered eight major exploit incidents in May 2026, with attackers draining a combined $328.6 million. The tally follows April 2026's spike in bridge-related losses, including the approximately $300 million KelpDAO incident on April 18 and Drift Protocol's $200 million-plus exploit days later. Data cited in the report also puts total 2026 hack losses beyond $750 million through mid-April, with May's events adding further losses such as the Verus-Ethereum bridge drain of about $11.5 million.

Polymarket is dealing with a surge of contested market outcomes tied to its UMA Optimistic Oracle process, raising concerns about arbitration reliability and user losses. The dispute focus includes an Israel–Hezbollah cease-fire market and a Wall Street Journal-profiled bettor who lost a $567 position after betting the cease-fire would not happen. The platform also remains exposed to U.S. regulatory pressure under its 2022 CFTC consent order that required blocking U.S. users.

Aave has re-enabled borrowing against wrapped Ether (WETH) after restoring WETH loan-to-value ratios to pre-incident levels across several Aave V3 deployments. The move follows a temporary freeze tied to the rsETH recovery process after the April 18 Kelp DAO bridge exploit and is described as the final step of Phase II of the rsETH technical recovery plan.

Poland’s parliament approved a government-backed bill to implement the EU's Markets in Crypto-Assets Regulation (MiCA) on Friday, as the country faces a July deadline to adopt the rules. The move came while prosecutors expanded an investigation into the collapse of Zondacrypto, where authorities estimate customer losses exceeded 350 million zlotys (about $96 million). Political disputes over how strictly to regulate crypto also continued, including debate over competing proposals and a separate push to ban cryptoasset activity entirely.