Blockaid: Crypto hacking losses hit $1.18bn, issuer blacklists recovered nothing

In short

• Blockaid says 60 major onchain exploits from January to August 2026 stole about $1.18 billion.
• Only $9.8 million, or 0.8%, was returned to victims as of 2 September.
• Every dollar recovered or frozen came through governance, protocol or validator action; issuer blacklists recovered nothing.
• Attackers moved funds a median 17 minutes after an exploit, with 13 moving within the first minute.

Blockaid says crypto hacking losses hit $1.18bn

On 19 October 2026, blockchain security firm Blockaid reported crypto hacking losses of about $1.18bn in 60 major onchain exploits from January through August 2026. Only $9.8m, or 0.8%, had been returned to victims as of 2 September, and none of it came through a stablecoin issuer's blacklist or freeze function. Every dollar that was frozen or returned came from onchain governance systems, protocol controls or network validators, Blockaid said. InvestIn.News found the figures show recovery stays extremely difficult even as chain tracking and forensics tools improve, with almost all the stolen crypto still out of victims' reach.

The Defiant carried the Blockaid findings on 20 October, and Crypto Briefing followed on 21 October. In Crypto Briefing's account, just five of the 60 incidents produced any funds that were frozen or given back. Protocols, governance bodies and validators accounted for $90.4m of the $91.2m secured in total, or 99.1%, rather than token issuers.

Why issuer blacklists recovered nothing

Blockaid said 16 of the 60 exploits were technically eligible for an issuer blacklist, but no such action was taken, according to KuCoin. Attackers moved funds a median of 17 minutes after an exploit across the 59 incidents with movement data, Unchained reported via Crypto Briefing. Funds moved within an hour in 40 cases and within the first minute in 13. Blockaid co-founder and CEO Ido Ben-Natan said 'Seventeen minutes is an incredibly short window for any security team to detect an attack'. Much of the stolen money sat in ETH, Bitcoin, wrapped tokens and liquid staking tokens that lack a central issuer, so a token freeze button had nothing to pull.

How governance and validators secured $90.4m

The largest recoveries came from teams with onchain authority, according to Crypto Briefing. The Arbitrum Security Council froze about $71m after the Kelp DAO exploit, roughly $9m in unauthorised Syscoin tokens were burned, and Stellar validators quarantined $6.9m after the Blend exploit. These were among the biggest interventions behind the $90.4m that was frozen or returned through governance and validators.

Hackers still control $287m across 16 incidents in wallets that can be tracked but not frozen, mostly in ETH, Bitcoin, wrapped tokens and liquid staking tokens that lack a central issuer. Around $229m traces to the April Drift exploit, with roughly 107,165 ETH sitting in three attacker addresses, according to Blockaid. For users of the exploited protocols, the practical effect is that almost all the $1.18bn remains lost, with $1.04bn still unrecovered.

Reaction on X to Blockaid's numbers

On X, Satoshi Drops (@SatoshiDropsHQ) said 60 major crypto exploits between January and August 2026 took $1.18bn, with only $9.8m returned and attackers shifting the money a median 17 minutes after each one. C³ Research (@C3ResearchAI) also posted on X that blacklists run by issuers recovered nothing, with funds coming back only through governance or validator moves rather than any issuer switch.

What Blockaid recommends next

Blockaid recommended that protocols decide in advance who has authority to freeze funds and what evidence is required, according to Crypto Briefing. It also said organisations should keep monitoring compromised addresses, because a transfer to an exchange or a freezable asset could open a window to intervene. The report gives teams a concrete path for turning future recoveries into governance or validator decisions rather than relying on token issuers.

Questions readers ask

How much was stolen in crypto hacks in 2026?

Blockaid counted about $1.18 billion stolen in 60 major onchain exploits from January through August 2026. As of 2 September, only $9.8 million, or 0.8%, had been returned to victims, according to Blockaid.

Why did stablecoin issuer blacklists recover nothing?

Blockaid said attackers moved funds a median of 17 minutes after an exploit, and much of the stolen money sat in ETH, Bitcoin, wrapped tokens and liquid staking tokens without a central issuer. Of 16 attacks eligible for an issuer blacklist, no action was taken, according to KuCoin.

What did governance and validators recover?

Of the $91.2 million frozen or returned, $90.4 million came through protocol governance or validators. Interventions included $71 million frozen by the Arbitrum Security Council, $9 million in Syscoin tokens burned and $6.9 million quarantined by Stellar validators.

How much remains frozen or unrecovered?

Blockaid said $81.4 million had been frozen but not returned as of 2 September, and $1.04 billion remained unrecovered. Hackers still controlled $287.1 million across 16 incidents in wallets that can be tracked but not frozen.

Our view

At InvestIn.News, we think Blockaid's crypto hacking losses expose a gap between freeze marketing and onchain reality. Issuer blacklists sound decisive, but the data showed attackers moved funds a median 17 minutes after an exploit, often into assets with no central issuer that can pull a kill switch. Governance bodies and validators were the only actors that froze or returned funds in this dataset, because they already have authority over the chain or protocol rather than needing a token issuer to act.

That does not mean blacklists are useless. It means security teams should not rely on them as a recovery tool, and victims should understand that a freeze promise is only as good as the actor who can enforce it. The concrete development that would change our view is a stablecoin issuer publicly showing a meaningful freeze of exploit proceeds, or a protocol adopting pre-agreed freeze rules that demonstrably recover funds in a future incident.

Follow the latest Stablecoins updates as they happen on Stablecoins NewsFeeds.

— Keshav Aggarwal