Stablecoin Blacklists Recovered Nothing in 60 Exploits

gm, Defiers!

These are the biggest stories in DeFi and crypto:

• Blockaid: blacklists recovered $0 in 60 exploits
• Ethereum staking hit a record 43.8M ETH
• Extended moves from Starknet to Arc Oct. 22
• Liquid reopened swaps; peg-outs stay frozen
• Utah sued Kalshi and Susquehanna

When crypto is stolen, the first call usually goes to a stablecoin issuer. Tether and Circle can add an address to a blacklist in one transaction, and the tokens at that address stop moving. A blacklist does not return the money; it only holds it in place. Today Blockaid, a blockchain security firm, published a count of what those freezes achieved this year. Who can actually stop stolen crypto, and does a freeze ever pay victims back?

Blockaid traced 60 exploits between Jan. 5 and Aug. 5 that took $1.18 billion. So far, $9.8 million has been returned to victims, or 0.8%. Another $81.4 million is frozen but not returned. An issuer blacklist was available in 16 of the incidents and used in none of them. In 19 incidents, $97.2 million still sits where a named party could freeze it, and no one has. The stolen funds started moving a median of 17 minutes after each exploit.

The money that was held came from controls inside protocols and chains. They account for 99% of the $91.2 million frozen or recovered. Arbitrum's Security Council froze $71 million after the KelpDAO exploit. Syscoin burned $9 million of tokens its attacker had minted. Stellar's top validators rejected transactions from attacker accounts and held about $6.9 million.

The Drift case shows the limit of an issuer freeze. Drift lost $295.7 million in April, and much of it is now ETH, which has no issuer to call. Today a Drift-linked wallet sent 23,000 ETH, about $54.8 million, into Tornado Cash. Drift says about $9.2 million has been frozen since the attack. By our arithmetic, that is 3.1% of the loss.

I tested this once before. On Oct. 9, Tether froze USDT tied to the thefts from Ledger users, and I wrote that the victims were better off for it. That held for a small part of the money. The next day, the thieves moved funds into USDD, which Tether cannot freeze, and the freeze covered about $10 million. Eleven days later, Tether has announced no return of those funds to victims.

The controls that held money this year sit with security councils and validator sets. Those are the same powers that L2BEAT counts against a chain when it rates how much users must trust it. A chain that removes them gains a higher L2BEAT stage and loses the main tool that froze stolen funds this year.

Read more below!

As of 21:03 UTC, Oct. 20. Data: CoinGecko, Aave, Hyperliquid. Full list

WATCH

The Ledger Implant Factory: Mark Karpelès on Who's Building Spy Chips at Scale

Camila Russo talks with former Mt. Gox CEO Mark Karpelès, who has opened Ledger wallets bought from resellers in Japan, Singapore and Germany. He found boards with revision markings and regional antenna variants, built for volume. They cover who makes the implants and how many may still be unopened. Watch the full conversation.

SECURITY

Issuer Blacklists Recovered Nothing in 60 Crypto Exploits, Blockaid Finds

Blockaid traced 60 exploits worth $1.18 billion from January to August and found that stablecoin blacklists and exchange blocks recovered nothing. Funds started moving a median of 17 minutes after each exploit, and 68% had moved within an hour. Four incidents gave defenders no window at all. The deepest trail belongs to Drift, routed through 170 hops. Blockaid's sample covers only chains its tools trace, so 12 incidents, mostly on Monad, fall outside it. Blockaid sells the monitoring and co-signing tools its report recommends.

Issuer Blacklists Recovered Nothing in 60 Crypto Exploits, Blockaid Finds

thedefiant.io

BLOCKCHAINS

Ethereum Staking Hits Record 43.8 Million ETH, Bitwise Says

Ethereum validators held a record 43.8 million ETH at the end of September, 35.9% of supply, Bitwise reports. The gross staking yield fell to 2.63% from 2.81%, because Ethereum pays less per ETH as total stake grows and priority fees and MEV fell. Net inflows reached 1.99 million ETH, the sixth straight positive quarter. Solana showed the same pattern, with 69% staked and the yield down to 5.99%. Separately, a Lido engineer warned that queued deposits could be diverted to builder accounts at the Glamsterdam fork.

DEFI

Extended Plans Oct. 22 Settlement Move From Starknet to Arc

Extended plans to move settlement from Starknet to Circle's Arc on Oct. 22, a week after Starknet opened its vote on leaving Ethereum. USDT and wBTC are not available on Arc, so holders above $1 must approve a 1:1 conversion or withdraw first. Positions in sub-accounts that miss the deadline will be closed at the mark price, and Extended's notices give three different deadlines. Extended held about $118 million, almost all on Starknet. The same day, the Starknet Foundation launched its Bramble privacy wallet.

SECURITY

Liquid Says Bitcoin Swaps Are Restored While Peg-Outs Stay Frozen

Liquid restored swaps between bitcoin and L-BTC through supported providers, while direct redemptions from its federation stay frozen. The federation held 3,632 BTC against 4,235 L-BTC in circulation on Tuesday, or 85.8% coverage, the same 603 BTC gap The Defiant reported on Oct. 11. A Sept. 6 bug in Elements, the software behind the sidechain, created about 4,000 unbacked L-BTC. Peg-outs reopen only after full 1:1 backing returns, and the plan does not say who covers the gap or when.

REGULATION

Utah Sues Kalshi and Susquehanna Firms to Halt Alleged Illegal Betting

Utah sued Kalshi and two Susquehanna firms to stop sports, election and other event contracts it calls illegal gambling, and to recover profits. The suit targets Susquehanna as the market maker that takes the other side of retail trades, which extends state enforcement from the exchange to its liquidity providers. A federal judge ruled in August that federal commodities law does not shield Kalshi from Utah's gambling laws. An Illinois judge ruled the other way on Oct. 2. Kalshi had 32,940 verified Utah accounts in February.

Other Stories Worth Your Time

JPMorgan Extends JPM Coin to Ethereum for Institutional Clients — approved clients can now move JPMD between wallets on Base and Ethereum at any hour.

Anthropic Says Claude Traced NIST Curve Seeds to 1990s Timestamps — the finding makes a planted backdoor in the curves less plausible and does not weaken them.

THORChain Keeps ZEC Swaps Halted After Bug Triggers Vault Slash — the same v3.21 upgrade, targeted for Oct. 23, patches the Rujira exploit.

Qubic Halts Network After $1.3 Million Wallet Drain — SlowMist says keys could be recovered from six network samples; separately, Cysic halted its bridge after an unauthorized mint of 10 million CYS.

SharpLink Says It Deployed $400 Million Across Ether.fi and Lido — the Lido half matches a plan it announced in August.

France Moves Budget Vote Carrying Stablecoin Tax to Nov. 3 — deputies had adopted the swap tax 38–37 ahead of a vote first set for Oct. 20.

Papertrade Keeps PAPER Non-Transferable, Citing Perp Attack Risks — Aster then set a delisting for its PAPER perp.

Strategy Slides 9.6% After MSCI Decision, Outpacing Bitcoin’s Drop — also: Strive priced $630 million of SATS preferred, Super League holders backed Metaplanet's 2,100 BTC deal and SkyAI sold its SOL for a $201 million tender.

Visa and Mesh Plan Crypto Spending From Wallet Balances — plus Coinbase with Thunes for payouts, Western Union's Stablecard in 37 markets, and 1inch winding down its card.

DTCC Outlines 25-Security Tokenization Rollout on Canton and Besu — also: Sparkassen opened bitcoin trading, Sberbank won an exchange license, FINMA approved a retail bitcoin ETF and Ramp filed for an OCC trust charter.

Bitget to Buy Licensed Thai Exchange From Japan's GMO Internet — Bitget is also ending services for some users; MEXC is leaving Russia and Belarus, Blockchain.com launched options and Revolut had a service disruption.

Ether ETFs Lose $320 Million, Overtaking Bitcoin's Weekly Outflows — movers: STRK down 38% in a week, SYRUP down 24%, TIA up 23% in a day and COMP up 27%.

Lighter Launches BTC and ETH Binary Options on Core — also new: Pump.fun pre-IPO pairings, stock-token collateral on Arcus and Walt's AI perps trading.

Sentora’s OUSD Lending Vault Holds $42.5 Million on Tempo — and Frax listed six local-currency pools on Aerodrome holding about $241,000.

Lulo Says Boost Deposits Face 6.4% Drawdown From Neutrl Exposure — separately, Echo Protocol is winding down.

Celestia Activates Fibre, Opening Direct Validator Uploads for Rollups — also live: Optimum's block propagation layer and Injective's fixed gas costs.

Kevin Boon Succeeds Evan Cheng as Mysten Labs CEO — Cheng stays CTO and leads a new AI unit.

Nullmask Passes $50 Million in Private Volume and Launches Points Season One — a partner post on private trading volume.

Trending on The Defiant