"Prevention is the cure. Rapid containment will always beat forensics," Blockaid co-founder and Chief Executive Ido Ben-Natan said in the report.
Seventeen Minutes To Move
Across the 59 incidents with a full hop-by-hop trace, stolen funds started moving a median of 17 minutes after the exploit transaction. In 22% of them the funds were already moving inside the first minute, and by the end of the first hour 68% had seen funds move. Four incidents gave defenders no window at all: Arbitrum CPK, Aztec Connect, Lml Token and TMM.
Blockaid traced 1,115 hops in total, a median of 13 per incident. The deepest laundering trail belonged to Drift, where 107,165 $ETH worth about $229 million sits across three attacker addresses, routed through 170 hops and seven levels of fan-out.
The Button Nobody Pressed
In 19 incidents, $97.2 million is still sitting in a state where a named party could freeze it today. In none of the 19 has anyone done so.
A further $287.1 million across 16 incidents is held in attacker addresses that are known and watched, in assets like $ETH, BTC and stETH that have no issuer to call. Another $375.4 million went through mixers and $190.8 million dispersed beyond attribution.
Blockaid separates the question of where funds are from the question of whether anyone can block them, and calls conflating the two "the most common error in public recovery reporting." The firm counts five channels that can freeze a balance: a token contract blacklist held by the issuer, a project-held pause or blacklist, an exchange compliance block, a validator set that rejects transactions from named accounts, and governance or protocol administration.
What Actually Worked
Of the $91.2 million recovered or frozen this year, $90.4 million came through controls built into the protocol or the chain, or 99%. Five incidents produced the entire figure.
The Arbitrum Security Council froze $71 million after the KelpDAO exploit. Syscoin burned $9 million in tokens its attacker had minted without authorization. Stellar's Tier-1 validators rejected transactions from attacker accounts in the Blend Protocol case, immobilizing roughly 48 million XLM worth $6.9 million. Volo Protocol on Sui froze its remaining vaults the same day, holding $3.5 million. The attacker behind the Across Solana Relayer incident returned 331.8 $ETH worth $800,000 under a 10% bounty.
Blockaid identified the Stellar attacker wallets itself, which it notes in the report. Funds under a Security Council hold or a validator quarantine are counted as frozen rather than recovered, since none of it has been returned.
The Freeze Debate
The finding lands in the middle of a live argument about issuer freezes. Tether blacklisted four THORChain vaults holding 1.45 million $USDT on Oct. 9 and unfroze them three hours later. Funds taken from Ledger users moved into USDD, outside Tether's freeze controls, the same week. Conduit is suing Tether over $2.76 million in frozen $USDT.
Sixty Of Seventy-Four
The dataset covers what Blockaid could trace. The firm cataloged 74 incidents, dropped one duplicate and one below its $900,000 size floor, then excluded a further 12 that happened on chains its tooling does not cover, primarily Monad and several non-EVM chains.
"Rates in this report are therefore rates over what could actually be traced rather than over what was disclosed," the report says. It also states that "the classification is Blockaid's own, and the figures in this report depend on it." The 60 incidents are not enumerated in full.
To be included, an incident had to be publicly disclosed, involve an onchain transfer of user or protocol funds to attacker control, have a reproducible starting point Blockaid's tools could work from, and cost more than roughly $900,000. Phishing and malware losses, front-end takeovers with no onchain drain, governance attacks that moved no assets, and exchange insider theft are all excluded.
The headline loss figure holds up against public data. DefiLlama records $1.22 billion across 82 incidents above $900,000 in the same Jan. 5 to Aug. 5 window, and $2.34 billion across 304 incidents for the year to Oct. 20.
Blockaid sells onchain monitoring, transaction co-signing and stablecoin governance tooling, the three product lines its recommendations point to. The firm flagged the UNCX vesting pool exploit on Oct. 14.
thedefiant.io
