Hackers who stole crypto this year still control $287.1 million in wallets that investigators can watch but have no means to freeze, blockchain security company Blockaid said in a report it released on Monday. The firm examined 60 major onchain exploits from January through August 2026, which it said accounted for $1.18 billion in stolen funds.
By Blockaid’s count, only $9.8 million, or 0.8%, had made it back to victims as of Sept. 2, the report’s cutoff. Another $81.4 million was frozen but not yet handed back. Just five of the 60 incidents saw any money frozen or recovered.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Minutes, Not Hours
Blockaid measured how fast attackers moved funds after an exploit in 59 cases and put the median at 17 minutes. In 40 of them (68%) the money moved within an hour, and in 13 (22%) it moved within the first minute.
“Seventeen minutes is an incredibly short window for any security team to detect an attack, identify where the money went, and coordinate a response,” Ido Ben-Natan, Blockaid’s co-founder and CEO, said in a statement accompanying the report.
Visible but Out of Reach
The $287.1 million is spread across 16 incidents. Most of it sits in assets with no central issuer able to block transfers from a given address, such as ETH, bitcoin, wrapped tokens and liquid staking tokens.
About $229 million of it traces to the April exploit of Drift, with roughly 107,165 ETH held in three attacker addresses as of Sept. 2, Blockaid said. The firm added that a transfer to an exchange or into a freezable asset could open a chance to step in, while routing the coins through a mixer would make recovery much harder.
Who Did the Freezing
Of the $91.2 million frozen or returned, $90.4 million (99.1%) was secured through controls run by protocols, governance bodies or validators, by Blockaid’s tally. That total includes the Arbitrum Security Council’s freeze of about $71 million tied to the Kelp DAO exploit. Blockaid also credited about $9 million at Syscoin, where unauthorized tokens were burned, and about $6.9 million that Stellar validators quarantined after the Blend exploit.
Blockaid, which sells tools that screen blockchain transactions, recommended that protocols and institutions decide ahead of time who has the authority to freeze funds and what evidence that requires, and keep monitoring compromised addresses. Ben-Natan said in the statement that organizations need to “block dangerous transactions before funds are stolen in the first place.”
Related Listen: How SEAL 911 and Arbitrum Froze $70M of North Korea’s Stolen Funds
The post Hackers Still Hold $287 Million in Stolen Crypto That Can’t Be Frozen, Blockaid Report Says appeared first on Unchained.