Issuer Blacklists Recovered No Funds Across 60 Crypto Exploits

Issuer blacklists recovered no funds across 60 major onchain exploits from January through August 2026, while protocols, governance bodies and validators secured nearly all the assets frozen or returned.

By Sept. 2, victims had received $9.8 million of the $1.18 billion taken in the 60 exploits, or 0.8%. Another $81.4 million had been frozen but not returned. Only five incidents involved any freeze or recovery.

Governance and validator actions accounted for $90.4 million of the $91.2 million in assets frozen or returned. The Arbitrum Security Council froze about $71 million after the Kelp DAO exploit, and Stellar validators quarantined $6.9 million after the Blend exploit. Around $9 million in unauthorized Syscoin tokens was burned.

In 16 cases, identified attacker wallets still held a combined $287.1 million. Bitcoin (BTC), Ether (ETH), wrapped tokens and liquid staking tokens made up most of those holdings; issuer blacklists could not freeze them at the address level. That amount represents funds still in identified attacker wallets, not the total unrecovered balance.

In 59 incidents with movement data, stolen funds first moved a median of 17 minutes after an exploit. Funds started moving within 60 minutes in 40 cases, including 13 in which movement started within one minute.