“Freezing” is often treated as synonymous with “recovery,” but the figures in this Blockaid report remind us that the two are not the same on the ledger. According to PANews, Blockaid tracked 60 crypto attacks between January 5 and August 5 this year, resulting in losses of $1.18 billion. Just $9.8 million was returned to victims, or 0.8%; another $81.4 million was frozen, while $1.04 billion remained unrecovered. More importantly, stablecoin issuers’ blacklist mechanisms and exchange interventions recovered no funds at all. In 16 incidents where issuers could have used blacklists, they were never activated.
My observation is that the difficulty of post-incident intervention is not just a matter of whether it is used, but whether it is used in time. The same report notes that the median time for stolen funds to start moving after an attack was 17 minutes. By the time an attack is identified and issuers or exchanges complete their response procedures, the funds may already have been bridged across chains, split up, or converted into other assets. Freezing can stop some funds from moving further, but that does not mean they are returned to victims. These are two separate figures and should be counted separately.
The report also shows that 99% of the $91.2 million recovered or frozen came from governance and validator measures at the protocol or chain level—for example, the Arbitrum Security Council froze $71 million after the KelpDAO incident. This suggests that what actually made a difference was more likely pre-existing permissions and governance responses at the protocol level, rather than post-incident blacklists. For readers evaluating a DeFi project, in addition to checking its audits, they should also consider whether it has a freeze or pause mechanism that can be activated quickly, and who has the authority to trigger it.
The conditions under which this conclusion holds should also be made clear: Blockaid’s figures cover 60 incidents within its tracking scope and reflect the methodology of a single security company, so they cannot be taken as a definitive conclusion about the entire industry. Going forward, it is worth tracking whether issuers disclose the criteria for activating blacklists, whether protocols establish freeze permissions in advance, and whether recovery rates change alongside governance measures. If this information remains opaque, the idea that “blacklists plus exchange interventions equal recoverable funds” remains a hypothesis that needs to be re-examined.
#稳定币 #Crypto Market
Sources:
PANews (originally published 10-21 08:56 Beijing Time)
https://www.panewslab.com/zh/articles/01a15bf5-8e3c-7358-a3e2-e76bfb1dd956
My observation is that the difficulty of post-incident intervention is not just a matter of whether it is used, but whether it is used in time. The same report notes that the median time for stolen funds to start moving after an attack was 17 minutes. By the time an attack is identified and issuers or exchanges complete their response procedures, the funds may already have been bridged across chains, split up, or converted into other assets. Freezing can stop some funds from moving further, but that does not mean they are returned to victims. These are two separate figures and should be counted separately.
The report also shows that 99% of the $91.2 million recovered or frozen came from governance and validator measures at the protocol or chain level—for example, the Arbitrum Security Council froze $71 million after the KelpDAO incident. This suggests that what actually made a difference was more likely pre-existing permissions and governance responses at the protocol level, rather than post-incident blacklists. For readers evaluating a DeFi project, in addition to checking its audits, they should also consider whether it has a freeze or pause mechanism that can be activated quickly, and who has the authority to trigger it.
The conditions under which this conclusion holds should also be made clear: Blockaid’s figures cover 60 incidents within its tracking scope and reflect the methodology of a single security company, so they cannot be taken as a definitive conclusion about the entire industry. Going forward, it is worth tracking whether issuers disclose the criteria for activating blacklists, whether protocols establish freeze permissions in advance, and whether recovery rates change alongside governance measures. If this information remains opaque, the idea that “blacklists plus exchange interventions equal recoverable funds” remains a hypothesis that needs to be re-examined.
#稳定币 #Crypto Market
Sources:
PANews (originally published 10-21 08:56 Beijing Time)
https://www.panewslab.com/zh/articles/01a15bf5-8e3c-7358-a3e2-e76bfb1dd956