Hackers Still Hold $287 Million in Stolen Crypto That Can’t Be Frozen, Blockaid Report Says

Introduction

A new Blockaid study of 60 on‑chain exploits from January through August 2026 paints a stark picture: hackers move stolen crypto at breakneck speed, and the vast majority of the funds remain out of reach. Of the $1.18 billion taken, just $9.8 million (0.8%) has been returned to victims, while $91.2 million has been frozen or earmarked for recovery. The remaining $287 million sits in attacker wallets that no central authority can block, underscoring the limits of current defensive tools.

How Fast the Money Vanishes

Blockaid measured the time between a breach and the first outbound transaction in 59 cases. The median lag was 17 minutes; 68 % of the hacks saw funds move within an hour, and 22 % within the first minute. Such rapid movement leaves security teams with a vanishingly small window to detect the breach, trace the flow, and coordinate a response. As Blockaid co‑founder Ido Ben‑Natan noted, “Seventeen minutes is an incredibly short window for any security team to detect an attack, identify where the money went, and coordinate a response.”

Where the Stolen Funds Hide

The $287.1 million that remains unrecovered is spread across 16 incidents, most of it in assets that lack a central issuer capable of freezing transfers—Ethereum, Bitcoin, wrapped tokens, and liquid‑staking derivatives. A single exploit, the April breach of the DeFi protocol Drift, accounts for about $229 million of that total, with roughly 107,000 ETH held in three attacker addresses as of early September.

Because these assets are permissionless, the only realistic path to recovery is to catch the funds when they move into a freeze‑able environment, such as a regulated exchange or a token that a protocol can lock. Once the coins are routed through mixers or other privacy‑preserving services, the trail quickly becomes opaque, making recovery nearly impossible.

Successful Freezes: Protocol‑Level Controls

Out of the 60 incidents, only five saw any money frozen or returned. Yet those few successes highlight a clear pattern: protocol‑level governance is the most effective tool. Blockaid tallied $90.4 million (99.1% of the frozen amount) secured by actions taken by protocol councils, validators, or governance bodies.

• Arbitrum Security Council froze about $71 million linked to the Kelp DAO exploit.
• Syscoin burned roughly $9 million of unauthorized tokens.
• Stellar validators quarantined $6.9 million after the Blend exploit.

These cases demonstrate that pre‑established authority to halt transactions—whether through a council vote, validator consensus, or smart‑contract pause function—can stop funds before they disappear into the broader ecosystem.

Recommendations for Defenders

Blockaid’s findings lead to three practical steps for protocols and institutions:

1. Define Freeze Authority in Advance – Decide who can trigger a freeze, under what evidence, and how quickly the decision can be enacted.
2. Implement Real‑Time Monitoring – Deploy tools that flag suspicious transfers from compromised addresses within minutes, giving responders a fighting chance.
3. Design for Containment – Use token standards and contract designs that allow selective freezing or burning of maliciously minted assets without jeopardizing legitimate users.

By embedding these controls before an attack occurs, organizations can shift from a reactive scramble to a proactive shield.

Closing Thoughts

The Blockaid report underscores a sobering reality: most stolen crypto simply cannot be reclaimed once it leaves the attacker’s wallet. Speed, decentralization, and the lack of centralized custodians make rapid, irreversible transfers the norm. However, the handful of successful freezes show that well‑crafted protocol governance can make a difference. As the crypto ecosystem matures, building robust, pre‑planned freeze mechanisms and real‑time monitoring will be essential to protect users and limit the financial fallout of future exploits.