Crypto users and projects lost $1.18 billion to exploits between January and August, and got back $9.8 million of it. That's the headline finding in a Blockaid report that examined 60 separate exploits, and the recovery figure comes with an awkward detail attached: not one of the recovered dollars arrived because a token issuer blacklisted a stolen address.
Every dollar that was frozen or returned came through governance or validator action, according to the report. The distinction matters for anyone who assumed that a blacklist function on a stablecoin or token contract is a safety net. In the 60 incidents Blockaid studied, it wasn't one.
Where the $9.8 million actually came from
Governance and validators, per the report. That covers the slow, procedural routes — proposals, votes, and the chain-level operators who can freeze or reverse state — rather than the automated contract tools that are often marketed as the first line of defense after a hack.
The recovery rate works out to a sliver of total losses. Blockaid's scope ran from January through August, so the $1.18 billion is a partial-year number and the $9.8 million is what came back inside that window. Money returned later, or recovered through routes the report didn't track, isn't in the figure.
The blacklist that didn't bite
Issuers blacklisted addresses. The recovered amount from those actions across all 60 exploits: zero. That's a blunt result for a mechanism that gets invoked publicly within hours of most major incidents, often with the implicit promise that stolen funds are being contained.
Blockaid doesn't offer a cause in the facts we have. The plausible reading is mechanical — blacklists stop a token from moving through compliant venues, but they don't pull funds out of a hacker's wallet, and they don't touch assets the issuer doesn't control. Whatever the reason, the report's split is clean: governance and validators produced the recoveries, blacklisting produced none.
A narrow sample with a clear split
Sixty exploits is a real sample, not a census. The report covers the incidents Blockaid examined, and its findings describe that set. It doesn't establish what happened in exploits outside it, and it doesn't break the $9.8 million down by case.
What it does establish is a ranking of remedies, at least for this stretch of 2026. The interventions that required collective sign-off or chain operators did the work. The ones baked into token contracts, and switched on fast, didn't return a cent in the cases studied.
The open question is whether the governance and validator recoveries were concentrated in a handful of high-profile cases or spread thinly across many — Blockaid's published figures don't say, and the answer changes what the $9.8 million means for the average victim.
