WORLDTECHToken Issuer Blacklists Stopped None of 60 Crypto Exploit Losses, Blockaid Finds
Security firm Blockaid reports that blacklists run by token issuers, the freeze tools creators can use against compromised addresses, produced no recoveries across 60 major on-chain exploits this year. According to the research, every dollar that was frozen or returned came through governance votes or validator intervention.
Recovery totals from the 60 exploits
Blockaid traced $1.18 billion in losses between January and August 2026, and only $9.8 million of that reached victims again, a recovery rate of 0.8%. By early September a further $81.4 million had been frozen, bringing the combined total recovered or frozen to $91.2 million. According to the firm, that still leaves the vast majority of stolen money in attackers' hands.
Blockaid found that 99.1% of that $91.2 million was returned through governance or validator actions. Issuer blacklisting, the tool that lets a token's creator block a compromised address, played no part in the recoveries the research recorded.
Speed and destination of stolen funds
Blockaid recorded a median of 17 minutes between an exploit and the movement of stolen assets, leaving little time for any freeze to take effect. Much of the money was sent into holdings that cannot be frozen, including native ETH, wrapped tokens and liquid staking derivatives, and some of it moved into mixers.
Native ETH has no central issuer to call, and the Ethereum protocol has no compliance desk able to freeze a wallet on request. That makes such assets an attractive destination for attackers seeking to avoid a blacklist.
Few incidents drew any response
Only five of the 60 incidents saw any recovery or freezing activity at all. The gap was therefore rare as an event as well as small in dollar terms.
Drift Protocol holdings remain unfrozen
As of early September, attackers still held $287.1 million in traceable stolen assets tied to 16 incidents. Blockaid noted that no freezing mechanism is available for these holdings.
Open questions
- Can governance or validator actions recover the $287.1 million that attackers still hold?