Protocols & Policy · Security
Blockaid's study of 60 major 2026 exploits found $90.4M of $91.2M recovered or frozen came through protocol or chain controls. This week's Initia halt-and-bridge-out and X100 same-transaction drain show what those levers can and cannot reach.
When an on-chain exploit hits, the question that matters for operators is not who tweets first. It is which control can still touch the money. Blockaid's "2026 Fund Recovery Threat Landscape," a 15-page study of 60 major onchain exploits from January through August, puts a hard number on that gap: of $91.2M recovered or frozen in its set, $90.4M came through controls built into the protocol or the chain, and $0 from issuer blacklists or exchange deposit blocks (p.2) [1]. Blockaid sells monitoring and co-signing tools; the figures below are from its PDF, page-tagged.
This week's Initia halt-and-bridge-out and X100 same-transaction treasury path are live tests of that map. Neither is a grade of the teams. Each shows what a mechanism can reach, and what it cannot.
Blockaid cataloged 60 major onchain exploits between January 5 and August 5, 2026, that together took about $1.18B (p.4) [1]. Of that total, $9.8M had been returned to victims, another $81.4M was frozen but not returned, and $1.04B remained unreturned (p.4) [1]. Only 5 of the 60 incidents produced any recovery or freeze at all, totaling $91.2M (p.9) [1]. Valuations in the report are fixed at September 2, 2026, 00:00 UTC (p.12) [1].
The channel split is the tell. Protocol or chain controls delivered $90.4M of that $91.2M; the remaining $0.8M was an attacker return under a negotiated 10% bounty in the Across Solana Relayer case (p.2) [1]. Blockaid's dashboard rounds the protocol-and-chain share to "99% of $91M" (p.3) [1]. The five named channels on its recovery table are governance or Security Council ($71.0M, KelpDAO via Arbitrum Security Council), protocol burn or mint reversal ($9.0M, Syscoin), validator quarantine ($6.9M, Blend on Stellar), chain or protocol freeze ($3.5M, Volo on Sui), and attacker-returned funds ($0.8M, Across) (p.9) [1]. Issuer blacklist and exchange compliance freeze each show $0; an issuer blacklist was technically available in 16 incidents and used in none (p.2, p.9) [1].
Speed frames the rest. Stolen funds started moving a median of 17 minutes after the exploit transaction; by the end of the first hour, 68% of incidents had already seen funds move (p.5) [1]. Separately, $287.1M across 16 incidents sat in attacker-controlled addresses that are known and watched but out of reach, in assets such as ETH with no issuer to call (p.2, p.10) [1]. Across 19 other incidents, $97.2M was still in a state where a named party could technically freeze it, and in none of the 19 had that balance been frozen (p.2, p.9) [1].
Initia's first official account of Friday's incident says an attacker exploited a bug in MoveVM script caching at 10:59 a.m. ET on Oct. 23, credited itself unbacked tokens, and bridged out about $2.7 million before the network halted: 105 WETH and about 1.4 million AUSD0 via LayerZero, plus about 1.08 million USDC via Noble and CCTP [2]. Initia said the proceeds were swapped for 1,135.52 ETH at 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8 on Ethereum mainnet, and that the Initia L1 and its rollups remain halted [2].
Le Coin's on-chain re-check at Ethereum block 26,265,468 (~6:22 p.m. ET Oct. 24) found that address still holding about 1,135.52 ETH, with nonce 0 [3]. The mechanism point is mechanical. A chain halt can stop further movement on that chain. It does not freeze ETH that has already left for Ethereum mainnet. Ether has no issuer blacklist path of the kind Blockaid measured at $0 across its set (p.2, p.9) [1]. Visible and watched is not the same as freezable.
Separately, Ethereum transaction 0x38c60844... at 10:11:47 a.m. ET on Oct. 24 shows a flash-loan borrow, two Senate seats locked, a treasury sale, loan repay and about 4.75 million USDT to the attacker inside one successful transaction [4]. Two ordinary governance checks (a voting-power snapshot taken before a proposal is created, and a timelock between vote and execution) were not in that path [4]. Le Coin's re-check found the first sender, 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63, emptied to dust (~0.00002359 ETH) with nonce 4 [3]. Funds that have already left the first address are past any pause that would have applied only inside the drained contracts.
Defimon (@DefimonAlerts), in a 5:02 p.m. ET Oct. 24 post, said wallet 0x7ec2 was already flagged by Blockaid and offered to relay a return-for-bounty deal; Le Coin attributes that Blockaid-flag claim to Defimon and has not independently verified it from Blockaid's own channels [5]. That attribution is not a recovery total and is not scored as one of Blockaid's five successful freeze cases.
The industry habit is to treat a stablecoin issuer blacklist or an exchange deposit hold as the backstop. In Blockaid's 60-incident set, those two channels delivered nothing (p.2, p.9) [1]. The dollars that did come back or freeze came from parties that already had a pre-wired protocol or chain control and used it (p.2, p.9) [1]. Identification alone resolved no incident in the set (p.2) [1].
That does not mean issuer or exchange tools never matter outside this sample. It means that, for these 60 cases through early August, hoping for a post-hoc freeze after funds sit in native ETH or leave through a same-block governance path is hoping for a channel the study measured at zero.
Initia's bridged ETH sits where Blockaid's "visible, not freezable" pile lives: known address, no issuer lever (p.2, p.10) [1][2][3]. X100's emptied first sender matches the median pressure the study describes: money already moving inside the first hour in most incidents (p.5) [1][3][4]. The recoveries that worked in 2026 depended on Security Councils, burns, validator quarantine and protocol freezes that existed before the exploit, not on a later phone call to an issuer (p.9) [1].
Holding the Corner.
Not financial advice.