Who stops a hack? Initia and X100 against this year's recovery record

When an on-chain exploit hits, the question that matters for operators is not who tweets first. It is which control can still touch the money. Blockaid's "2026 Fund Recovery Threat Landscape," a 15-page study of 60 major onchain exploits from January through August, puts a hard number on that gap: of $91.2M recovered or frozen in its set, $90.4M came through controls built into the protocol or the chain, and $0 from issuer blacklists or exchange deposit blocks (p.2) [1]. Blockaid sells monitoring and co-signing tools; the figures below are from its PDF, page-tagged.

This week's Initia halt-and-bridge-out and X100 same-transaction treasury path are live tests of that map. Neither is a grade of the teams. Each shows what a mechanism can reach, and what it cannot.

What the recovery record actually looks like

Blockaid cataloged 60 major onchain exploits between January 5 and August 5, 2026, that together took about $1.18B (p.4) [1]. Of that total, $9.8M had been returned to victims, another $81.4M was frozen but not returned, and $1.04B remained unreturned (p.4) [1]. Only 5 of the 60 incidents produced any recovery or freeze at all, totaling $91.2M (p.9) [1]. Valuations in the report are fixed at September 2, 2026, 00:00 UTC (p.12) [1].

The channel split is the tell. Protocol or chain controls delivered $90.4M of that $91.2M; the remaining $0.8M was an attacker return under a negotiated 10% bounty in the Across Solana Relayer case (p.2) [1]. Blockaid's dashboard rounds the protocol-and-chain share to "99% of $91M" (p.3) [1]. The five named channels on its recovery table are governance or Security Council ($71.0M, KelpDAO via Arbitrum Security Council), protocol burn or mint reversal ($9.0M, Syscoin), validator quarantine ($6.9M, Blend on Stellar), chain or protocol freeze ($3.5M, Volo on Sui), and attacker-returned funds ($0.8M, Across) (p.9) [1]. Issuer blacklist and exchange compliance freeze each show $0; an issuer blacklist was technically available in 16 incidents and used in none (p.2, p.9) [1].

Speed frames the rest. Stolen funds started moving a median of 17 minutes after the exploit transaction; by the end of the first hour, 68% of incidents had already seen funds move (p.5) [1]. Separately, $287.1M across 16 incidents sat in attacker-controlled addresses that are known and watched but out of reach, in assets such as ETH with no issuer to call (p.2, p.10) [1]. Across 19 other incidents, $97.2M was still in a state where a named party could technically freeze it, and in none of the 19 had that balance been frozen (p.2, p.9) [1].

Initia: a halt that stops the chain, not Ethereum ETH

Initia's first official account of Friday's incident says an attacker exploited a bug in MoveVM script caching at 10:59 a.m. ET on Oct. 23, credited itself unbacked tokens, and bridged out about $2.7 million before the network halted: 105 WETH and about 1.4 million AUSD0 via LayerZero, plus about 1.08 million USDC via Noble and CCTP [2]. Initia said the proceeds were swapped for 1,135.52 ETH at 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8 on Ethereum mainnet, and that the Initia L1 and its rollups remain halted [2].

Le Coin's on-chain re-check at Ethereum block 26,265,468 (~6:22 p.m. ET Oct. 24) found that address still holding about 1,135.52 ETH, with nonce 0 [3]. The mechanism point is mechanical. A chain halt can stop further movement on that chain. It does not freeze ETH that has already left for Ethereum mainnet. Ether has no issuer blacklist path of the kind Blockaid measured at $0 across its set (p.2, p.9) [1]. Visible and watched is not the same as freezable.

X100: same-transaction path, emptied sender

Separately, Ethereum transaction 0x38c60844... at 10:11:47 a.m. ET on Oct. 24 shows a flash-loan borrow, two Senate seats locked, a treasury sale, loan repay and about 4.75 million USDT to the attacker inside one successful transaction [4]. Two ordinary governance checks (a voting-power snapshot taken before a proposal is created, and a timelock between vote and execution) were not in that path [4]. Le Coin's re-check found the first sender, 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63, emptied to dust (~0.00002359 ETH) with nonce 4 [3]. Funds that have already left the first address are past any pause that would have applied only inside the drained contracts.

Defimon (@DefimonAlerts), in a 5:02 p.m. ET Oct. 24 post, said wallet 0x7ec2 was already flagged by Blockaid and offered to relay a return-for-bounty deal; Le Coin attributes that Blockaid-flag claim to Defimon and has not independently verified it from Blockaid's own channels [5]. That attribution is not a recovery total and is not scored as one of Blockaid's five successful freeze cases.

The issuer-and-exchange backstop

The industry habit is to treat a stablecoin issuer blacklist or an exchange deposit hold as the backstop. In Blockaid's 60-incident set, those two channels delivered nothing (p.2, p.9) [1]. The dollars that did come back or freeze came from parties that already had a pre-wired protocol or chain control and used it (p.2, p.9) [1]. Identification alone resolved no incident in the set (p.2) [1].

That does not mean issuer or exchange tools never matter outside this sample. It means that, for these 60 cases through early August, hoping for a post-hoc freeze after funds sit in native ETH or leave through a same-block governance path is hoping for a channel the study measured at zero.

Initia's bridged ETH sits where Blockaid's "visible, not freezable" pile lives: known address, no issuer lever (p.2, p.10) [1][2][3]. X100's emptied first sender matches the median pressure the study describes: money already moving inside the first hour in most incidents (p.5) [1][3][4]. The recoveries that worked in 2026 depended on Security Councils, burns, validator quarantine and protocol freezes that existed before the exploit, not on a later phone call to an issuer (p.9) [1].

Sources

1. Blockaid, "2026 Fund Recovery Threat Landscape" (PDF, 15 pages; form download via https://www.blockaid.io/fund-recovery-2026), file sha256 d3020b1f3869af45ad5ccfd90486cda88a8213975f47ffdfaea231c79dff96f0; page cites p.2, p.3, p.4, p.5, p.9, p.10, p.12; accessed Oct. 25, 2026, ~2:27 a.m. ET.
2. Initia (@initia), post on X, Oct. 24, 2026, 4:46 a.m. ET, https://x.com/initia/status/2113915002008612945, accessed Oct. 24, 2026, 9:27 a.m. ET.
3. Ethereum JSON-RPC eth_getBalance and eth_getTransactionCount via ethereum.publicnode.com at block 26,265,468 (~6:22 p.m. ET Oct. 24, 2026); Initia address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8 about 1,135.52 ETH (nonce 0); X100 first sender 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63 about 0.00002359 ETH (nonce 4). Raw pack file: onchain-recheck.v1.md (sha256 37507ee312f3250885331a7fb47a4a78393d09afe643cdaadbee0f630ef273fe).
4. Ethereum transaction 0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0, https://etherscan.io/tx/0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0; block 26,263,022 timestamp 2026-10-24T14:11:47Z (10:11:47 a.m. ET); mechanism detail also covered in Le Coin's separate X100 flash-loan explainer.
5. Defimon (@DefimonAlerts), post on X, Oct. 24, 2026, 5:02 p.m. ET, https://x.com/DefimonAlerts/status/2114100145151217832 - Blockaid flag / return-for-bounty claims attributed to Defimon only; accessed Oct. 24, 2026, ~6:22 p.m. ET.

Holding the Corner.

Not financial advice.