About US$ 287.1 million in stolen cryptocurrencies remains in addresses identified on the blockchain, but with no mechanisms available to block its movement. The figure is part of a survey released by security company Blockaid on Monday (19), which analyzed 60 attacks that occurred between January and August 2026.
The incidents caused estimated losses of US$ 1.18 billion. As of September 2, only US$ 9.8 million had been returned to victims, equivalent to 0.8% of the total. Another US$ 81.4 million was frozen but had not yet been returned. Only five of the 60 attacks recorded any freezing or recovery of funds.
Why locating stolen cryptocurrencies does not mean recovering the money
The US$ 287.1 million identified by Blockaid is distributed across 16 incidents. A large portion corresponds to assets such as Bitcoin, Ether and certain tokens that do not have a central entity capable of preventing transfers directly from an address.
The largest concentration is related to the attack on the Drift protocol, which occurred in April. Approximately US$ 229 million remained associated with this incident, including about 107,000 ETH distributed across three addresses controlled by the attackers.
Even when a freezing mechanism exists, blocking the assets does not mean returning them to their owners. The survey identified US$ 91.2 million in frozen and recovered amounts, of which US$ 90.4 million was protected by mechanisms operated by protocols, governance bodies or validators.
The speed of the criminals also makes recovery difficult. In the 59 incidents with data available on fund movement, the median time to the first transfer was only 17 minutes. In 40 cases, the funds began to be moved in the first hour; in 13, this happened in the first minute.
Ido Ben-Natan, cofounder and CEO of Blockaid, emphasized that 17 minutes represent an extremely short window for a security team to detect the attack, locate the funds and coordinate a response.
According to the company, the possibility of intervention depends on the mechanisms available in each network or asset. Subsequent transfers to exchanges or assets with blocking features may open new recovery opportunities, but do not guarantee the return of the funds.
