In brief
- Security firm Blockaid says $287.1 million of crypto stolen in 2026 sits in wallets that can be watched but not frozen.
- Across 60 major on-chain exploits from January to August, it puts the total stolen at $1.18 billion, with only 0.8% returned to victims by early September.
- Attackers moved funds in a median of 17 minutes. Almost every successful freeze used protocol or governance controls, not outside intervention.
If you hold crypto that was meant to be recoverable after a hack, Blockaid’s latest count is bleak. The firm says most of this year’s stolen funds never come back, and a large pile is sitting in plain sight with no freeze button attached.
Blockaid sells tools that screen blockchain transactions. Every figure below is its own count, as reported by Unchained on 19 October.
What did Blockaid count?
The firm examined 60 major on-chain exploits from January through August 2026. It said those accounted for $1.18 billion in stolen funds.
By its count, as of 2 September:
| Outcome | Blockaid’s figure |
|---|---|
| Total stolen (60 exploits) | $1.18 billion |
| Returned to victims | $9.8m (0.8%) |
| Frozen, not yet returned | $81.4m |
| Unfreezable (16 incidents) | $287.1m |
| Incidents with any freeze or recovery | 5 of 60 |
Why can’t that $287.1m be frozen?
Blockaid says the $287.1 million is spread across 16 incidents. Most of it sits in assets with no central issuer able to block transfers from a given address, such as ether, bitcoin, wrapped tokens and liquid staking tokens.
About $229 million of it traces to the April exploit of Drift, with roughly 107,165 ETH held in three attacker addresses as of 2 September, Blockaid said. The firm added that a transfer to an exchange or into a freezable asset could open a chance to step in, while routing the coins through a mixer would make recovery much harder.
How fast do attackers move the money?
Blockaid measured 59 cases and put the median at 17 minutes. In 40 of them (68%) the money moved within an hour, and in 13 (22%) within the first minute.
“Seventeen minutes is an incredibly short window for any security team to detect an attack, identify where the money went, and coordinate a response,” Ido Ben-Natan, Blockaid’s co-founder and CEO, said in a statement accompanying the report, according to Unchained.
What actually worked when funds were frozen?
Of the $91.2 million frozen or returned, $90.4 million (99.1%) was secured through controls run by protocols, governance bodies or validators, by Blockaid’s tally.
That includes the Arbitrum Security Council’s freeze of about $71 million tied to the Kelp DAO exploit, about $9 million at Syscoin where unauthorised tokens were burned, and about $6.9 million that Stellar validators quarantined after the Blend exploit, Unchained reported.
What does Blockaid recommend?
The firm recommended that protocols and institutions decide ahead of time who has the authority to freeze funds and what evidence that requires, and keep monitoring compromised addresses. Ben-Natan said organisations need to “block dangerous transactions before funds are stolen in the first place.”
Our read
This is TSN’s analysis. Blockaid is selling a product, so its stress on pre-planned freezes is also a pitch. Even so, the pattern it reports matches what compliance teams already see: once stolen coins sit in unfreezable assets, watching the wallet is not the same as stopping it. The Drift pile alone shows how much of the “recovered” story is still just visibility.
How we sourced this
- All dollar figures, times and percentages are Blockaid’s, as reported by Unchained. We did not obtain Blockaid’s download-gated PDF.
- Unchained notes that its article was produced with AI assistance and then reviewed and fact-checked by its editors.
- Blockaid sells screening tools; that commercial interest is noted above.
Sources
- Unchained: Hackers Still Hold $287 Million in Stolen Crypto That Can’t Be Frozen, Blockaid Report Says, 19 October 2026
- Blockaid: 2026 Fund Recovery Threat Landscape (report download page)
Related stories
- Qubic Halts Its Network After Attacker Drains 1,404 Wallets Through Weak Seeds
- Cysic Halts Its Cross-Chain Bridge After Unauthorised Mint of 10 Million CYS
- Base vault ~$6m loss: whitelist change, not an Aave core breach
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
