Blockaid finds issuer blacklists recovered nothing in 60 crypto exploits

Token issuers like to point to their freeze buttons as a safety net for when things go wrong. According to new research from Blockaid, that net caught exactly nothing across 60 major on-chain exploits this year. The security firm traced $1.18 billion in losses between January and August 2026. Every dollar that was frozen or returned came through governance votes or validator intervention, with issuer blacklists contributing zero. The numbers behind the recovery gap The headline figure is grim on its own. Of the $1.18 billion stolen, only $9.8 million made its way back to victims, a recovery rate of 0.8%. Another $81.4 million had been frozen by early September. That brings the total recovered or frozen to $91.2 million, which still leaves the vast majority of stolen funds in attackers’ hands. Blockaid found that 99.1% of that $91.2 million was clawed back through governance or validator actions. Issuer blacklisting, the mechanism that lets a token’s creator block a compromised address, played no part. Recovery was also rare as an event, not just in dollar terms. Only five of the 60 incidents saw any recovery or freezing activity at all. Seventeen minutes and gone Blockaid recorded ...