Hackers responsible for major cryptocurrency thefts in 2026 are still in possession of $287.1 million in stolen assets, according to blockchain security firm Blockaid. The company’s recent report reviewed 60 significant onchain exploits that occurred between January and August this year, totaling $1.18 billion in lost funds.
Rapid Movement Hampers Recovery
Blockaid detailed that attackers moved stolen assets at remarkable speed, with the median transfer occurring 17 minutes after an exploit. In 40 out of 59 analyzed cases, the funds shifted within an hour, while in 13 incidents, the transfers happened in less than a minute.
Ido Ben-Natan, co-founder and CEO of Blockaid, emphasized the challenges for security teams facing such swift operations. He noted that this brief timeframe leaves little opportunity for detection and response.
Seventeen minutes is an incredibly short window for any security team to detect an attack, identify where the money went, and coordinate a response, Ben-Natan stated in remarks released with the report.
Scale of Recoveries and Frozen Assets
Of the $1.18 billion in stolen funds, only $9.8 million—representing 0.8%—had been returned to victims by September 2. An additional $81.4 million was frozen but not yet reclaimed. Blockaid reported that just five out of the 60 incidents included any funds that had been frozen or recovered at all.
The analysis revealed that most of the $287.1 million currently held by hackers is spread across 16 specific incidents. The majority of this sum resides in cryptocurrencies with no central entity able to halt or freeze transactions, such as bitcoin, ETH, wrapped tokens, and liquid staking tokens.
A significant portion—about $229 million—traces back to the Drift exploit in April, including approximately 107,165 ETH controlled by just three addresses. Blockaid indicated that if these assets are transferred to an exchange or converted into tokens that can be frozen, recovery may be possible. However, routing stolen coins through mixing services substantially reduces the chance of retrieval.
Protocol Controls Enable Most Asset Freezes
Blockaid found that out of $91.2 million in funds either frozen or returned, $90.4 million—or 99.1%—had been secured because of protocol-level or governance controls. For example, the Arbitrum Security Council froze nearly $71 million tied to the Kelp DAO exploit. The firm also credited the burning of $9 million in unauthorized tokens on Syscoin and $6.9 million quarantined by Stellar validators after the Blend exploit.
To strengthen asset protection, Blockaid advised protocols and institutions to clarify who has authority to freeze funds and what kind of evidence would be required. The company further recommended continuous surveillance of addresses compromised in hacks.
Organizations must block dangerous transactions before funds are stolen in the first place, Ben-Natan urged, stressing the importance of proactive security measures.
Importance of Market and Activity Monitoring
Consistent monitoring has become essential, not only for preventing hacks but also for identifying emerging patterns in volatile sectors such as the meme token market. Technical analysis and real-time alerts play an important role in this environment, where an internet trend can quickly fuel massive investment interest. For instance, data from Fomo App highlights how a trade in “Niu Lai” transformed an initial $99 into approximately $370,000—demonstrating rapid profit potential and the importance of tracking token selections and trade timing.
Fomo App seeks to streamline these efforts by combining token discovery with trading tools, offering features like social feeds, investor rankings, and trade notifications on a single platform. This integrated approach aims to support more informed decisions amid dynamic market conditions.
