Blockaid finds issuer blacklists recovered nothing in 60 crypto exploits
译文准备中，暂时显示英文原文。查看英文原文
阅读字号阅读正文 ↓
加载图片中
The ineffectiveness of issuer blacklists in crypto exploits highlights the urgent need for improved preventive measures and rapid response systems.
Only 0.8% of $1.18 billion stolen this year has reached victims, with nearly every frozen dollar secured by protocols, governance or validators
Tue 20 Oct 2026 · 09:27 EDT · 2 min read
In Security
Share
Token issuer blacklists recovered none of the funds stolen in 60 major onchain exploits from January through August 2026, according to a report from security firm Blockaid released October 19.
The exploits accounted for $1.18 billion in stolen funds. As of September 2, only $9.8 million, or 0.8%, had been returned to victims, and another $81.4 million had been frozen but not yet returned, Tokenpost reported. Only five of the 60 incidents saw any funds frozen or recovered.
Of the $91.2 million frozen or returned, $90.4 million, or 99.1%, was secured through controls run by protocols, governance bodies or validators rather than token issuers.
Stolen funds move within 17 minutes
The largest interventions included about $71 million frozen by the Arbitrum Security Council after the Kelp DAO exploit, roughly $9 million in unauthorized Syscoin tokens that were burned and $6.9 million quarantined by Stellar validators after the Blend exploit.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
We respect your privacy. Unsubscribe anytime.
Attackers moved funds a median of 17 minutes after an exploit across the 59 incidents with movement data, Unchained reported. Funds moved within an hour in 40 cases and within the first minute in 13. “Seventeen minutes is an incredibly short window for any security team to detect an attack,” said Blockaid co-founder and CEO Ido Ben-Natan.
Hackers still control $287.1 million across 16 incidents in wallets that can be tracked but not frozen, mostly held in ETH, Bitcoin, wrapped tokens and liquid staking tokens that lack a central issuer. About $229 million traces to April’s Drift exploit, with roughly 107,165 ETH sitting in three attacker addresses.
Blockaid recommended that protocols decide in advance who has authority to freeze funds and what evidence is required, and that organizations keep monitoring compromised addresses, since a transfer to an exchange or freezable asset could open a window to intervene.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
