Stolen Crypto Tracker: Where Hacked Funds Went
Follow a hack's stolen funds hop by hop into bridges, swap protocols, mixers and exchanges, or see what still sits in attacker wallets.
Multi-chainTable · StrataPlanned
Stolen Crypto Recovered: Frozen, Returned and Seized Funds
How much of each hack's stolen crypto was later returned, frozen or seized, and how much is still lost?
How much of each hack came back and how: returned by the attacker, seized by authorities or frozen by an issuer or a chain.
ShareEmail it
Blueprint
What the table will hold.
The table as it will open in Strata. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
One row One row per recorded incident, with its recoveries up to the latest complete daySorted by Recovered, highest first
| Incident | Date | Chain | Value takenUSD | RecoveredUSD | Returned by attackerUSD | Frozen by issuersUSD | Frozen by chain governanceUSD | SeizedUSD | Net lossUSD | Share recovered | Receipt |
|---|---|---|---|---|---|---|---|---|---|---|---|
- Incident incident Text
- The protocol, bridge or exchange attacked, linked to its registry entry.
- Date date Date
- The day of the first attack transaction.
- Chain chain Chain
- The chain where the attack happened; funds that moved on are followed to other chains.
- Value taken value_taken Exact amount
- Token amounts taken in the attack, valued at the attack block.
- Recovered recovered Exact amount
- Everything returned, frozen or seized, valued at the attack block.
- Returned by attacker returned Exact amount
- Funds the attacker sent back, net of any agreed bounty.
- Frozen by issuers frozen_issuer Exact amount
- Stablecoins frozen in attacker addresses by their issuers.
- Frozen by chain governance frozen_chain Exact amount
- Funds frozen or moved by a chain's security council or validators.
- Seized seized Exact amount
- Funds moved to addresses controlled by law enforcement.
- Net loss net_loss Exact amount
- Value taken minus recovered: what the attacker still controls or has spent.
- Share recovered recovery_share Percent
- Recovered value as a share of value taken, both at attack-block prices.
- Receipt receipt Link
- The attack and recovery transactions behind the row.
Filter by Chain.
About
What it answers, and for whom.
Most stolen crypto is never returned, but some is: an attacker negotiates a bounty and sends the rest back, an issuer freezes the stablecoins in the attacker's wallet, a chain's governance moves funds out of reach or authorities seize them. This table takes each recorded incident and adds up what came back, by route, against what was taken, so the net loss and the recovery share are measured instead of announced.
Recovery has become part of how incidents end. In May 2025 Sui validators froze most of the funds taken from the Cetus DEX, and in April 2026 the Arbitrum Security Council froze ETH that the KelpDAO attacker held on Arbitrum. Each recovery here is an on-chain transaction tied to its incident, with the announcement that explains it recorded as the source.
Reimbursements are not counted as recovered. When a company or treasury repays users from its own funds, the attacker still holds what was taken, so the table keeps the two apart.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Each recovery is an on-chain transaction tied to an incident in the registry: a transfer from an attacker address back to the victim or a recovery address, an issuer freeze, a governance freeze or a transfer to a seizure address.
- Issuer freezes are read from Tether's AddedBlackList and DestroyedBlackFunds events and Circle's Blacklisted events on attacker addresses, valued at the balance frozen.
- Chain-level freezes are read from the governance or validator actions that executed them, such as a security council transaction moving funds to an address only governance can release, with the announcement recorded as the source.
- Returns are counted net of any bounty the attacker kept by agreement, and the bounty is recorded with its public terms.
- Recovered and taken amounts are both valued at attack-block prices, so the recovery share reflects tokens recovered, not price moves since the attack.
The data it needs
Chain data, with some off-chain sources
- security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- stablecoin_freezesTo buildStablecoin freezes and blacklistsAddresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Transfers from attacker addresses in the incident registry to victim, recovery and seizure addresses
- Tether AddedBlackList and DestroyedBlackFunds events and Circle Blacklisted events on attacker addresses
- Security council and validator freeze actions, recorded with the governance proposal or announcement (off-chain)
- Public bounty terms and law enforcement announcements, recorded with their source (off-chain)
Questions
Questions people ask.
Can stolen crypto be recovered?
Sometimes. Funds come back when an attacker returns them, often for a bounty, when stablecoins in the attacker's wallet are frozen by their issuer, when a chain's governance or validators freeze them or when authorities seize them. Each route leaves a transaction, and this table counts them per incident.
How much stolen crypto is recovered?
It varies by incident, from nothing to nearly all of it. Attacks that leave funds in freezable stablecoins or on chains with emergency powers recover more, while funds swapped to ETH or bitcoin and moved through mixers rarely come back. The table shows each incident's recovery share, so the range is visible.
What is a white hat bounty in a hack?
A negotiated deal in which the attacker returns most of the funds and keeps an agreed share, often around a tenth, in exchange for the protocol not pursuing them. The table records the share kept and counts only what was returned as recovered.
Can a blockchain freeze stolen funds?
Some can. Chains with a security council or with validators able to coordinate, such as Arbitrum and Sui, have frozen attacker funds after major exploits. Most chains have no such power, and each use of it is debated.
Is a reimbursement the same as a recovery?
No. A reimbursement is a company or treasury paying users back from its own funds, and the attacker keeps what was taken. A recovery takes funds back from the attacker's control. The table counts only recoveries and notes reimbursements beside them.
- Freeze
- Making an address unable to move a token or its funds, done by a stablecoin issuer on its token or by a chain's governance on the chain.
- Bounty
- The share of stolen funds an attacker may keep under a public agreement in return for sending the rest back.
- Seizure
- Funds taken into the control of law enforcement, visible on-chain as transfers to addresses the authorities control.
Related
More apps like this.
USDT Blacklist Tracker: Frozen USDT and USDC Wallets
Check whether an address is frozen by Tether or Circle, and follow how much USDT and USDC the issuers freeze, unfreeze and destroy.
Multi-chainEthereumTronBiggest Crypto Hacks of All Time, Ranked
The largest hacks and exploits on record, ranked by value taken at the time, with the attack type, the chain and how much came back.
Multi-chainBiggest Bridge Hacks, Ranked by Losses and What Failed
Cross-chain bridge exploits ranked by value taken, with each bridge's design, the failure behind the loss and how much came back.
Multi-chainEthereumBNB Chain+3Crypto Hack Tracker: Exploits and Losses This Year
Every major hack and exploit of the year with the amount taken, how the attackers got in and where the stolen funds sit now.
Multi-chainBitcoin Quantum Risk: BTC in Exposed Public Key Addresses
Bitcoin held in outputs whose public keys are already visible on-chain, split by script type and tracked day by day.
BitcoinBuild Stolen Crypto Recovered: Frozen, Returned and Seized Funds on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.