Blockaid Finds Hackers Hold $287 Million in Stolen Crypto Beyond Freezing Reach

Hackers who targeted crypto protocols between January and August 2026 still hold $287.1 million across addresses that investigators can track but cannot freeze, according to a report published by blockchain security firm Blockaid on Oct. 19 ¹. The unfreezable sum spans 16 separate incidents and is largely held in assets lacking centralized blacklist mechanisms, including $ETH, Bitcoin ($BTC), wrapped assets, and liquid staking tokens ¹.

Blockaid reviewed 60 onchain exploits accounting for $1.18 billion in total losses ¹. As of the report's Sept. 2 cutoff, only $9.8 million—or roughly 0.8% of the total stolen—had returned to victims ¹. Another $81.4 million remained frozen but had not yet been repatriated ¹. In total, only five of the 60 tracked security breaches resulted in any asset recoveries or freezes ¹. The bulk of the unfreezable balance stems from an April breach of Drift, where roughly 107,165 ETH worth approximately $229 million remained under attacker control across three addresses on Sept. 2 ¹.

The Speed of Fund Movement

The report highlighted that incident response teams face rapidly narrowing mitigation windows ¹. Across 59 analyzed cases, attackers initiated asset transfers at a median of 17 minutes following the initial exploit ¹. Attackers shifted funds within an hour in 68% of incidents, and in 22% of breaches, funds moved during the first minute ¹. Blockaid co-founder and chief executive Ido Ben-Natan stated that 17 minutes presents an extraordinarily constrained timeline to identify illicit flows and mount a coordinated defensive action ¹.

Where funds were successfully contained, decentralized interventions drove results ¹. Of the $91.2 million that was either frozen or returned, protocol-level controls, governance interventions, and validator actions accounted for $90.4 million, or 99.1% ¹. Notable containment efforts included the Arbitrum Security Council freezing approximately $71 million linked to a breach of Kelp DAO, Syscoin burning roughly $9 million in unauthorized tokens, and Stellar validators isolating $6.9 million after an exploit targeting Blend ¹. Blockaid advised institutions and developers to predefine administrative emergency powers and evidentiary requirements to intervene before stolen assets enter mixing services ¹.