Signal Snapshot
- Stolen crypto almost never comes back. That is the story now.
- Hackers still hold about $287 million that no one can freeze. The funds sit in wallets that people can see but cannot touch.
- Those hacks took about $1.18 billion in total.
- That is less than 1% of what was taken.
- Attackers moved funds a median 17 minutes after the hack. Speed is the edge. Defense has to be ready before the attack.
Key Takeaways
- Blockaid tracked 60 hacks that took about $1.18 billion, and most of the money is still gone.
- It matters because speed beats response, and frozen funds do not mean returned funds.
- The real read is simple. Pre-built controls decide if victims see any money again.
What Happened
Blockaid released a new report on Monday. The firm says it reviewed 60 major onchain exploits.
The headline number is stark. Hackers still control $287.1 million in wallets that can be watched but cannot be frozen. According to Blockaid report findings. That pile is visible onchain. No one has a button to stop it.
Total thefts in the set reached $1.18 billion. That is about 0.8% of the total.
The report also found attackers moved funds a median 17 minutes after the hack.
The firm points to one fix that worked best. Most successful freezes came from protocol-level controls, as described in protocol-level freeze controls. Those are tools built into a project before launch. They can pause moves or block bad transfers. Blockaid says teams should plan them before an attack, not after.
Why It Matters
Think of a bank robbery where the getaway car leaves in 17 minutes. Police arrive in an hour. The timeline tells the whole tale.
Crypto moves faster than banks. Once funds leave a hacked contract, they can hop across wallets in seconds. Each hop makes recovery harder. The first minutes matter more than the first days.
Frozen is not the same as returned. A freeze stops movement. A return puts coins back in victims hands. Legal steps take time. Claims take time. Victims wait.
The $287.1 million pile matters for trust. It sits in the open. Anyone can see it. No one can grab it. That hurts faith in onchain safety. Users ask a fair question. If we can see the thief, why can we not stop him?
The answer is design. Some coins have a freeze switch. Many do not. Plain ether and many DeFi tokens have no central off button. If the project did not build a pause or block list, there is nothing to press after the fact.
This is where second-order effects kick in. Builders now face pressure to add safety switches at launch. Users may start to favor projects with those switches. That shifts how teams design contracts. Safety becomes a feature, not an afterthought.
For Token Metrics readers, the lesson is plain. Do not count on recovery after a hack. The data says recovery is rare. Assume stolen funds stay stolen.
Market Context
This is a security event, not a market move. Prices did not cause it. Weak code and fast thieves did.
Security shapes how money flows. When hacks rise, users pull back. They keep less cash in hot apps. They split funds across wallets. They wait longer before trying new launches. That slows growth for honest teams too.
The timing matters. The release is Oct. 19. So the read is fresh. It sums up most of this year in one place.
The sample is focused. Sixty cases is not every scam. It is large onchain exploits. That focus helps. It strips out small phishing losses and spam. It shows what skilled attackers can take from protocols.
The recovery rate frames the risk. Less than 1% back to victims is tiny. It tells users that insurance and safety nets are thin. It tells teams that post-hack action rarely works. The work has to happen up front.
What would change the read? A jump in returns would. If more of the 60 cases show late recoveries, the 0.8% figure looks old. If not, the headline stands. Most stolen crypto stays gone.
What would prove it was mostly noise? Proof that the $287.1 million is actually stuck or lost to the thieves too. Or proof that victims were paid back offchain in ways the report missed. Neither is in the inputs we have. So we stick with what Blockaid found.
Risks to Watch
The first risk is speed. A median 17 minutes leaves almost no room to react. Teams that need human sign-off will be too slow. Attackers automate. Defenders must automate too.
The second risk is false hope around freezes. A freeze makes headlines. It does not pay victims. Legal fights can drag on. Custody can drag on. Watch whether frozen funds move to returns or sit still.
The third risk is design trade-offs. Pause buttons can stop thieves. They can also stop users. A badly set control can freeze honest money. Teams must test who can press the button and when.
The fourth risk is user habits. If people think watchers will save them, they take more risk. They click more links. They try unaudited apps. The data says no rescue is coming in most cases. That belief needs to reset.
The fifth risk is copycat attacks. Public reports teach both sides. Defenders learn where controls help. Attackers learn where they do not. The next wave will target projects without pre-built blocks.
What to Watch Next
- Watch the frozen pile. Returns would lift the 0.8% rate.
- Watch the unfrozen pile. Does the $287.1 million move, split, or sit still? Movement in the first hour after past hacks was the norm.
- Watch new launches. Do more teams ship with pause or block tools on day one? Blockaid says that planning matters most.
- Watch case count.
- Watch user guidance from major wallets and apps. Do they warn more clearly that recovery is rare? Clear words can cut losses.
- This is context, not advice. It explains what happened. It does not tell you what to buy or sell. Do your own homework and stay careful.
