Mentioned in This Article
1. Crypto Hacks Leave $287 Million Beyond Reach
Hackers who drained crypto protocols this year still control $287.1 million in wallets that investigators can watch but cannot freeze, according to a report released Monday, October 19, by blockchain security company Blockaid. The study covered 60 major onchain exploits from January through August 2026 that together took $1.18 billion, and found that attackers began moving the money a median of 17 minutes after each hack.
The headline finding is how little has gone back to victims. As of the report's September 2 cutoff, only $9.8 million, or 0.8% of the stolen total, had been returned. A further $81.4 million had been frozen but not yet handed back. Money was frozen or recovered in only five of the 60 incidents, which means that in 55 cases nothing was clawed back at all.
The numbers frame a central problem in decentralized finance: once an exploit succeeds, the window to react is extremely short, and the tools that can halt stolen funds depend largely on decisions made before the attack. The sections below set out what Blockaid measured, where the remaining funds sit and which kinds of controls have actually worked.
2. How Much Stolen Crypto Has Been Recovered?
Very little. The $9.8 million returned to victims is less than 1% of the $1.18 billion taken across the 60 exploits. Adding the $81.4 million that is frozen but not yet released brings the total frozen or returned to $91.2 million, which is roughly 7.7% of the amount stolen.
Frozen funds are not the same as recovered funds. When assets are frozen, they are immobilized so that the thief cannot move them, but they must still pass through a process before returning to their owners. That process can involve governance votes, legal steps or negotiations, so frozen money may take months to reach victims, and some of it may not.
The concentration of results is also telling. Only five of the 60 incidents involved any freeze or recovery. For the large majority of victims, the stolen money simply left, and the report suggests that the usual outcome of a major exploit is permanent loss.
3. How Fast Do Attackers Move Stolen Funds?
Quickly. Blockaid measured the time between an exploit and the first movement of stolen funds in 59 of the cases, and the median was 17 minutes. In 40 of those cases, or 68%, the funds moved within an hour. In 13 cases, or 22%, they moved within the first minute.
Those timings leave little room for a response. Ido Ben-Natan, Blockaid's co-founder and chief executive, said in a statement that 17 minutes is not enough time for a security team to detect an attack, trace where the funds went and take action. A typical response requires several steps, from spotting abnormal activity to contacting the parties who can intervene, and each step consumes minutes that attackers use to disperse or convert assets.
The speed explains why recovery rates are so low. By the time a team has confirmed that an exploit is underway, the stolen assets have often already been split across addresses, swapped into other tokens or sent to destinations where freezing is impossible. The report treats this tempo as a structural feature of onchain theft rather than an exception.
4. Why Can't the $287 Million Be Frozen?
Most of the $287.1 million sits in assets that have no central issuer able to block transfers from a particular address. The report cites ETH, bitcoin, wrapped tokens and liquid staking tokens as examples. The money is spread across 16 incidents.
This contrasts with some stablecoins, where the issuing company can blacklist an address and halt transfers. Native assets such as ETH and bitcoin operate on networks that have no administrator with that power, so once a thief controls them, the holder can move them freely. Investigators can see every transaction on a public blockchain, which is why the funds are described as visible but out of reach: they can be tracked in real time, yet nobody has the authority to stop them.
Visibility still has value. Tracking lets analysts notice when funds move toward an exchange or a service where cooperation is possible, and it provides evidence for later law enforcement action. But without a point of control, observation alone does not return the money.
5. The Drift Exploit and Its ETH Still in Attacker Hands
A single incident accounts for most of the unfrozen total. About $229 million of the $287 million traces to the April exploit of Drift. As of September 2, roughly 107,165 ETH was held in three attacker addresses.
Blockaid said that a transfer of those funds to an exchange or into a freezable asset could open a chance for intervention. If the attacker converts the ETH into a token whose issuer can block transfers, or deposits it with a platform that complies with freeze requests, the situation changes. On the other hand, routing the funds through a mixer would make recovery much harder, because mixers are designed to break the link between deposits and withdrawals.
The Drift case shows how concentrated the risk is. One incident holds the bulk of the money that remains outstanding, so developments around those three addresses could shift the overall recovery picture more than all other incidents combined.
6. Who Actually Froze the Money?
Of the $91.2 million that was frozen or returned, $90.4 million, or 99.1%, was secured through controls run by protocols, governance bodies or validators. In other words, nearly all successful interventions came from mechanisms built into the affected ecosystems rather than from outside parties.
The report gives three examples. The Arbitrum Security Council froze about $71 million tied to the Kelp DAO exploit. About $9 million was dealt with at Syscoin, where unauthorized tokens were burned. And about $6.9 million was quarantined by Stellar validators after the Blend exploit. Each relied on a group that had authority over the network or protocol and was able to act.
A security council is a small body of trusted participants empowered to take emergency actions on a network. Validators are the operators who confirm transactions and keep a blockchain running. When these groups agree to freeze or isolate assets, they can do what an individual victim cannot, but the power raises questions about decentralization, since the ability to freeze funds is also the ability to interfere with them.
7. What Does Blockaid Recommend?
Blockaid, which sells tools that screen blockchain transactions, recommends that protocols and institutions decide in advance who has the authority to freeze funds and what evidence is required before they do so. It also advises keeping watch over compromised addresses after an attack, since opportunities to intervene can appear later if funds are moved to a point of control.
The logic follows from the data. With a 17-minute median, there is no time to design a governance process once an exploit begins. Rules about who may act, under what conditions and with what proof have to exist beforehand, so that a response can start within minutes rather than days.
Ben-Natan said organizations need to block dangerous transactions before funds are stolen in the first place. That emphasis on prevention fits the finding that recovery is rare: the most reliable way to avoid losses is to stop a malicious transaction from executing at all.
8. What the Findings Mean for DeFi Security
The report's figures point to a gap between how fast attacks unfold and how slowly the response machinery works. With only 0.8% returned and $1.18 billion lost across 60 incidents, the cost of that gap is measurable. Protocols weighing their emergency options must balance the speed that freezing demands against the decentralization that users expect.
The data also shows that a few well-prepared mechanisms account for nearly all of the recovery. If a protocol has no council, no validator-level quarantine and no pause function, it has few options once attackers begin moving funds. Those that have such controls, and have tested them, have achieved the only meaningful recoveries this year.
The study's window ends in August, with recovery status measured on September 2, so the picture may have changed since. Funds that are frozen could still be returned, and funds that are free could still be moved into positions where they can be stopped. For now, the main fact stands: $287.1 million remains in attacker hands, visible on the blockchain and out of anyone's power to halt.
9. What to Watch Next
Two things will determine whether the recovery picture improves. The first is the movement of the largest unfrozen holdings. The roughly 107,165 ETH linked to the Drift exploit remains in three addresses, and any transfer to an exchange, into a freezable asset or through a mixer would change the odds of intervention. Blockaid advises continued monitoring of such addresses for exactly that reason.
The second is whether protocols adopt the advance planning the report calls for. Agreeing in peacetime on who may freeze funds and what evidence justifies it is a governance task that takes time, and the findings suggest that projects without it will have little chance of reacting within the median 17 minutes. The report does not give dates for any upcoming decisions, so the next evidence will come from the next exploit and how quickly its victims, councils and validators respond. Until then, the figures in the report remain the best available measure of how little is recovered once attackers act.