---
title: "Blockaid Finds Hackers Hold $287 Million in Stolen Crypto Beyond Freezing Reach"
description: "Across 60 major exploits in 2026, less than 1% of the $1.18 billion stolen has been returned to victims, while attackers move funds in a median of 17 minutes."
url: https://basisdesk.news/news/blockaid-unfreezable-stolen-crypto-report
published: 2026-10-19T13:06:51.071Z
modified: 2026-10-19T13:06:51.071Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [ETH, BTC]
tags: [Blockaid, Exploits, DeFi, Arbitrum, Drift, Ethereum]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Blockaid Finds Hackers Hold $287 Million in Stolen Crypto Beyond Freezing Reach

Across 60 major exploits in 2026, less than 1% of the $1.18 billion stolen has been returned to victims, while attackers move funds in a median of 17 minutes.

## At a glance

- **What happened:** Blockaid reported that attackers retain $287.1 million across 16 exploits in native crypto assets that cannot be frozen, with less than 1% of 2026 stolen funds returned.
- **Why it matters:** The findings show incident response mechanisms are routinely outpaced by attackers moving funds in a median of 17 minutes.
- **Who is affected:** Exploit victims, decentralized protocols, and security teams managing onchain emergency responses.
- **What's next:** No next step announced.
- **Primary source:** [Hackers Still Hold $287 Million in Stolen Crypto That Can’t Be Frozen, Blockaid Report Says](https://unchainedcrypto.com/hackers-still-hold-287-million-in-stolen-crypto-that-cant-be-frozen-blockaid-report-says/) — unchainedcrypto.com

## Key points

- Hackers control $287.1M in unfreezable assets across 16 exploits analyzed by Blockaid between January and August 2026.
- Only $9.8M, or 0.8% of the $1.18B stolen in 60 major exploits, was returned to victims by Sept. 2.
- Attackers moved illicit funds at a median of 17 minutes post-exploit, with 22% moving assets within the first minute.

## Editorial remark

- **Context:** Exploit response has historically leaned on centralized stablecoin issuers to freeze illicit wallets, but stolen native and decentralised assets remain technically impossible to blacklist on base layers.
- **Impact:** Exploited protocols face near-total losses, as 99.2% of stolen funds remain outside victim hands unless caught within minutes by validator- or governance-level controls.
- **Watch:** Whether protocols formalize emergency pause councils or whether attackers shift routing through mixers before off-ramping to centralized exchanges.

Hackers who targeted crypto protocols between January and August 2026 still hold $287.1 million across addresses that investigators can track but cannot freeze, according to a report published by blockchain security firm Blockaid on Oct. 19 [1]. The unfreezable sum spans 16 separate incidents and is largely held in assets lacking centralized blacklist mechanisms, including $ETH, Bitcoin ($BTC), wrapped assets, and liquid staking tokens [1].

Blockaid reviewed 60 onchain exploits accounting for $1.18 billion in total losses [1]. As of the report's Sept. 2 cutoff, only $9.8 million—or roughly 0.8% of the total stolen—had returned to victims [1]. Another $81.4 million remained frozen but had not yet been repatriated [1]. In total, only five of the 60 tracked security breaches resulted in any asset recoveries or freezes [1]. The bulk of the unfreezable balance stems from an April breach of Drift, where roughly 107,165 ETH worth approximately $229 million remained under attacker control across three addresses on Sept. 2 [1].

## The Speed of Fund Movement

The report highlighted that incident response teams face rapidly narrowing mitigation windows [1]. Across 59 analyzed cases, attackers initiated asset transfers at a median of 17 minutes following the initial exploit [1]. Attackers shifted funds within an hour in 68% of incidents, and in 22% of breaches, funds moved during the first minute [1]. Blockaid co-founder and chief executive Ido Ben-Natan stated that 17 minutes presents an extraordinarily constrained timeline to identify illicit flows and mount a coordinated defensive action [1].

Where funds were successfully contained, decentralized interventions drove results [1]. Of the $91.2 million that was either frozen or returned, protocol-level controls, governance interventions, and validator actions accounted for $90.4 million, or 99.1% [1]. Notable containment efforts included the Arbitrum Security Council freezing approximately $71 million linked to a breach of Kelp DAO, Syscoin burning roughly $9 million in unauthorized tokens, and Stellar validators isolating $6.9 million after an exploit targeting Blend [1]. Blockaid advised institutions and developers to predefine administrative emergency powers and evidentiary requirements to intervene before stolen assets enter mixing services [1].

## Sources

1. [Hackers Still Hold $287 Million in Stolen Crypto That Can’t Be Frozen, Blockaid Report Says](https://unchainedcrypto.com/hackers-still-hold-287-million-in-stolen-crypto-that-cant-be-frozen-blockaid-report-says/) — unchainedcrypto.com, 2026-10-19

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai