Hackers behind crypto thefts this year still control $287.1 million in stolen assets held in wallets that investigators can watch but have no way to freeze, according to a report released Monday by blockchain security company Blockaid.
The firm examined 60 major onchain exploits from January through August 2026 and said those incidents accounted for $1.18 billion in stolen funds. By Blockaid’s count, only $9.8 million, or 0.8%, had been returned to victims as of Sept. 2, the report’s cutoff date. Another $81.4 million had been frozen but not yet returned. Only five of the 60 incidents saw any funds frozen or recovered.
Attackers often move funds within minutes
Blockaid measured how quickly attackers moved funds after an exploit in 59 cases. The median time was 17 minutes.
In 40 of those cases, or 68%, the money moved within an hour. In 13 cases, or 22%, it moved within the first minute.
“Seventeen minutes is an incredibly short window for any security team to detect an attack, identify where the money went, and coordinate a response,” Blockaid co-founder and CEO Ido Ben-Natan said in a statement released with the report.
$287.1 million remains visible but cannot be frozen
The $287.1 million is spread across 16 incidents, the report said. Most of it is held in assets that do not have a central issuer capable of blocking transfers from a specific address, including ETH, bitcoin, wrapped tokens, and liquid staking tokens.
About $229 million of that total is tied to the April exploit of Drift. As of Sept. 2, roughly 107,165 ETH was held across three attacker addresses, according to Blockaid.
The firm said a transfer to an exchange or into a freezable asset could create an opportunity to intervene. If the funds are routed through a mixer, recovery becomes much harder.
Most freezes came from protocol or validator controls
Of the $91.2 million that was either frozen or returned, $90.4 million, or 99.1%, was secured through controls run by protocols, governance bodies, or validators, based on Blockaid’s tally.
That figure includes the Arbitrum Security Council’s freeze of about $71 million linked to the Kelp DAO exploit.
Blockaid also counted about $9 million at Syscoin, where unauthorized tokens were burned, and about $6.9 million quarantined by Stellar validators after the Blend exploit.
Blockaid’s recommendations
Blockaid, which sells tools for screening blockchain transactions, said protocols and institutions should decide in advance who has the authority to freeze funds, what evidence is required, and how compromised addresses will be monitored on an ongoing basis.
Ben-Natan said in the statement that organizations need to stop dangerous transactions before funds are stolen in the first place.
