Token issuers like to point to their freeze buttons as a safety net for when things go wrong. According to new research from Blockaid, that net caught exactly nothing across 60 major on-chain exploits this year.
The security firm traced $1.18 billion in losses between January and August 2026. Every dollar that was frozen or returned came through governance votes or validator intervention, with issuer blacklists contributing zero.
The numbers behind the recovery gap
The headline figure is grim on its own. Of the $1.18 billion stolen, only $9.8 million made its way back to victims, a recovery rate of 0.8%.
Another $81.4 million had been frozen by early September. That brings the total recovered or frozen to $91.2 million, which still leaves the vast majority of stolen funds in attackers’ hands.
Blockaid found that 99.1% of that $91.2 million was clawed back through governance or validator actions. Issuer blacklisting, the mechanism that lets a token’s creator block a compromised address, played no part.
Recovery was also rare as an event, not just in dollar terms. Only five of the 60 incidents saw any recovery or freezing activity at all.
Seventeen minutes and gone
Blockaid recorded a median of just 17 minutes between an exploit and the movement of stolen assets.
The stolen funds were mostly routed into non-freezable assets such as native ETH, wrapped tokens, and liquid staking derivatives, with some moving into mixers.
Native ETH has no central issuer to call. There is no compliance desk at the Ethereum protocol level that can freeze a wallet on request, which makes it an attractive destination for anyone trying to outrun a blacklist.
The Drift Protocol overhang
As of early September, hackers still held $287.1 million in traceable stolen assets tied to 16 incidents. Blockaid noted that no freezing mechanism is available for these holdings.
One incident dominates that pile. The April exploit of Drift Protocol, a Solana-based platform, accounts for around $229 million of the stolen amount still sitting in identifiable wallets.
That position includes approximately 107,165 ETH spread across three identifiable addresses.
Who Blockaid is, and why the data carries weight
Blockaid is not a niche observer. Its on-chain security tooling is used by major platforms including Coinbase, MetaMask, and Uniswap to assess transaction risk.
What this means for protocols, users, and investors
For users, the most uncomfortable takeaway is how slim the odds of getting money back are after an exploit. A 0.8% return rate means that, in practice, prevention is nearly the only protection that works.
For protocols, the data points to governance and validator coordination as the mechanisms that actually delivered results. When funds were recovered in this sample, it was because a community or a set of validators moved quickly, not because an issuer flipped a switch.
If the median window before funds move is 17 minutes, any system built to respond in hours or days is essentially working on a different clock than the attackers.
The 16 incidents still holding $287.1 million in traceable funds show that the playbook of routing into non-freezable assets is working.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.