Blockaid Report Finds Issuer Blacklists Recovered Nothing in 60 Crypto Exploits

Blacklists froze nothing in 60 traced exploits

Stablecoin issuers blacklisting addresses and exchanges blocking deposits recovered no money in the 60 crypto exploits that security firm Blockaid traced, according to a new Blockaid report. Crypto exploits are attacks that drain funds from a project or its users.

Blockaid cataloged the 60 incidents between Jan. 5 and Aug. 5, 2026, and fixed every verdict and dollar valuation at Sept. 2. Of the $1.18 billion taken in those incidents, $9.8 million has been returned to victims, $81.4 million is frozen but not returned, and $1.04 billion remains unreturned. The returned share works out to 0.8%.

An issuer blacklist — a token issuer's ability to block an address — was technically available in 16 of the traced incidents and used in none of them, Blockaid found. The money that did come back came through governance and validator action instead.

Key numbers from the report

• $1.18 billion traced across 60 exploits from Jan. 5 to Aug. 5, 2026.
• $9.8 million returned to victims, $81.4 million frozen but not returned, $1.04 billion unreturned.
• $97.2 million across 19 incidents still sits where a named party could freeze it today; in none of the 19 has anyone done so.
• $287.1 million across 16 incidents is held in known and watched attacker addresses in assets with no issuer to call.
• $375.4 million went through mixers, and $190.8 million dispersed beyond attribution.
• Of the $91.2 million recovered or frozen, $90.4 million came through protocol or chain controls, or 99%, across five incidents.

Funds moved within minutes

Across the 59 incidents with a full hop-by-hop trace, stolen funds started moving a median of 17 minutes after the exploit transaction. In 22% of cases the funds were already moving inside the first minute, and by the end of the first hour 68% had seen funds move.

Four incidents gave defenders no window at all: Arbitrum CPK, Aztec Connect, Lml Token and TMM.

Blockaid traced 1,115 hops in total, a median of 13 per incident. The deepest trail belonged to Drift, where 107,165 ETH worth about $229 million sits across three attacker addresses, routed through 170 hops and seven levels of fan-out.

What worked: protocol and validator freezes

Blockaid says the recovery that did happen came from controls built into the protocol or the chain. Five incidents produced the entire $91.2 million figure:

• The Arbitrum Security Council froze $71 million after the KelpDAO exploit.
• Syscoin burned $9 million in tokens its attacker had minted without authorization.
• Stellar's Tier-1 validators rejected transactions from attacker accounts in the Blend Protocol case, immobilizing roughly 48 million XLM worth $6.9 million.
• Volo Protocol on Sui froze its remaining vaults the same day, holding $3.5 million.
• The attacker behind the Across Solana Relayer incident returned 331.8 ETH worth $800,000 under a 10% bounty.

Blockaid identified the Stellar attacker wallets itself, which it notes in the report. Funds under a Security Council hold or a validator quarantine are counted as frozen rather than recovered, since none of it has been returned.

How Blockaid drew the line on freeze channels

Blockaid counts five channels that can freeze a balance: a token contract blacklist held by the issuer, a project-held pause or blacklist, an exchange compliance block, a validator set that rejects transactions from named accounts, and governance or protocol administration.

The firm separates the question of where funds are from the question of whether anyone can block them, and calls conflating the two "the most common error in public recovery reporting."

Freezes under debate elsewhere

The finding lands in the middle of an ongoing argument about issuer freezes. Tether blacklisted four THORChain vaults holding 1.45 million USDT on Oct. 9 and unfroze them three hours later. Funds taken from Ledger users moved into USDD, outside Tether's freeze controls, the same week. Conduit is suing Tether over $2.76 million in frozen USDT.

What the dataset leaves out

The report covers what Blockaid could trace. The firm cataloged 74 incidents, dropped one duplicate and one below its $900,000 size floor, then excluded a further 12 on chains its tooling does not cover, primarily Monad and several non-EVM chains.

To be included, an incident had to be publicly disclosed, involve an onchain transfer of user or protocol funds to attacker control, have a reproducible starting point Blockaid's tools could work from, and cost more than roughly $900,000. Phishing and malware losses, front-end takeovers with no onchain drain, governance attacks that moved no assets, and exchange insider theft are all excluded.

The report states that "the classification is Blockaid's own, and the figures in this report depend on it," and that rates are over what could actually be traced rather than over what was disclosed. The 60 incidents are not enumerated in full. Blockaid also sells onchain monitoring, transaction co-signing and stablecoin governance tooling — the three product lines its recommendations point to.

How the loss figure compares

DefiLlama records $1.22 billion across 82 incidents above $900,000 in the same Jan. 5 to Aug. 5 window, and $2.34 billion across 304 incidents for the year to Oct. 20.

What Blockaid says should happen instead

"Prevention is the cure. Rapid containment will always beat forensics," Blockaid co-founder and Chief Executive Ido Ben-Natan said in the report. The report's recommendations point to the three product lines the firm sells.

Sources

• The Defiant