Stolen Crypto Recovery Rates: How Much Is Returned or Frozen

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. In recent full-year data, roughly 8% to 16%. PeckShield's figures put recovered or frozen funds at about 8% of 2025's $4.04 billion stolen, and 16% of 2024's. Immunefi counted 7.7% for 2024. Quarters swing wider.

Watch: Stolen Crypto Recovery Rates: How Much Is Returned or Frozen 1:44

Video transcript

How much stolen crypto comes back? Not much. Recent full-year data puts it at roughly eight to sixteen percent, and the number depends on what each source counts.

PeckShield's figures put recovered or frozen funds at about 8 percent of the 4.04 billion dollars stolen in 2025, and about 16 percent in 2024.

Immunefi counted 7.7 percent for 2024. Quarters swing wider, from 0.4 percent in early 2025, the Bybit quarter, to 33 percent in the third quarter of 2026.

Operator cover makes users whole, but Hacken counts it separately, because the stolen assets stay with the attackers.

Funds come back three ways: a freeze before they are swapped, a negotiated return, sometimes minus a bounty, or a seizure, which can take years.

Freezes act fastest. After the October Binance theft, TRM Labs says about 2.7 billion dollars was frozen within hours. The attacker still held about 2.4 billion in ETH and bitcoin.

Victims get targeted twice. The FTC says anyone who contacts you asking for an upfront fee is a scammer. The FBI adds that private recovery firms cannot issue seizure orders.

Red flags include a fee up front, a guaranteed return, unsolicited contact claiming to be a law firm or the FBI, and any request for your seed phrase.

The sooner a theft is seen, the more of it can still be frozen. Guardian's Managed Security monitors contracts on every block. Read the full article, or talk to Guardian.

How much stolen crypto comes back? Not much, and the answer depends on what each source counts.

We compared reports from PeckShield, Immunefi and Hacken, TRM Labs' analysis of the largest theft on record, and DefiLlama's hacks dataset.

For each, we say plainly what "recovered" means.

One warning first. Anyone who contacts you offering recovery for an upfront fee is a scammer, the FTC says.

The FBI says private recovery firms "cannot issue seizure orders."

Recovery Rate Data

Source	Period	Losses counted	Came back
PeckShield	2025	$4.04B, hacks and scams	$334.9M recovered or frozen (about 8%)
PeckShield	2024	$3.01B	$488.5M recovered or frozen (about 16%)
Immunefi	2024	$1.50B, hacks and fraud	$115.6M recovered in 14 cases (7.7%)
Immunefi	Q1 2025	$1.64B	$6.5M recovered (0.4%)
Hacken	Q3 2026	$1.18B, 107 incidents	$387M returned or reversed (33%)
TRM Labs	Binance, Oct 29, 2026	$6.36B, one theft	About $2.7B frozen within hours (about 42%)

Percentages marked "about" are our arithmetic on each source's own figures. PeckShield's are as BeInCrypto reported them; Hacken's as Cointelegraph reported them.

Quarters swing more: Immunefi counted 21.2% recovered in Q1 2024 and 0.4% in Q1 2025, the quarter of the Bybit theft.

What each source counts

PeckShield: hacks plus $1.37 billion in scams; funds recovered or frozen.
Immunefi: hacks and fraud; funds recovered, counted case by case.
Hacken: separates funds returned, reversed and covered by operators.
TRM Labs: funds frozen onchain, which is not yet returned.

Returned is not the same as covered

Hacken's Q3 2026 split shows why the definitions matter.

Returned or reversed: $387 million (33%), almost all from two incidents.
Liquid Network: self-described white hats returned $272 million, about 85%.
Tectonic: Cronos validators rolled back 114 minutes, reversing about $111.2 million.
Covered by operators: about $410 million, including $387 million from Bitget's user fund.
Neither: about $384 million (32%).

Operator cover makes users whole, but Cointelegraph notes the stolen assets stayed with the attackers.

DefiLlama's returned-funds field

DefiLlama's hacks dataset has a field for returned funds. In our pull of November 6, 2026, it is filled for 28 of 1,340 incidents.

It mixes outcomes, per DefiLlama's own descriptions:

Returned: Euler's and GMX's entries are funds attackers sent back.
Reimbursed: Banana Gun's and Unizen's record users being repaid, not funds coming back.
Bybit: all $1.4 billion is booked as returned.
Missing: the Liquid Network and Tectonic returns Hacken counts.

Yet the FBI said Bybit's thieves had dispersed the assets "across thousands of addresses on multiple blockchains."

Summed anyway, the field shows 12.8% of 2022 to 2026 losses returned, and 5.7% without Bybit.

Returned Through Negotiation

Some attackers give funds back, sometimes keeping a bounty. DefiLlama and Hacken record these cases:

Euler, March 2023: about $197 million taken; returned within weeks, completed by early April.
GMX V1, July 2025: $42 million taken; returned on July 12, minus a $5 million bounty.
Liquid Network, Q3 2026: $272 million returned by self-described white hats, per Hacken.

The largest thefts did not end this way. After the Binance theft, TRM says the attacker still held about $2.4 billion in ETH and BTC beyond any issuer's reach.

How to run a negotiation, from the onchain message to sanctions checks, is in our guide to negotiating with a hacker after a DeFi exploit.

Frozen by Issuers and Exchanges

Freezes act fastest. They only work while funds are still in a token or account someone can freeze.

The Binance theft, October 2026

Per TRM Labs, these freezes landed within hours of the October 29 theft:

Tether: about 1.77 billion USDT, the first 971.1 million at 21:01 UTC.
Circle: about 825 million USDC, starting at 21:04 UTC.
Ripple and World Liberty Financial: 40.5 million RLUSD and 27.8 million USD1.
Arbitrum Security Council: about $30 million in ETH and ARB.

The attacker raced the freezes. TRM says about 325 million USDT was sold for ETH at a discount of more than 10%.

Elsewhere

Bitget, September 2026: Circle and Tether froze about $340,000, per Hacken.
Ankr, December 2022: Binance froze $3 million of about $5 million taken.
Grinex, April 2026: attackers swapped USDT into TRX and ETH at once to beat freezes.

Frozen is not yet returned. Tether says it has frozen more than 7 billion USDT in all.

It says about 1.2 billion USDT obtained through fraud and theft has gone back to owners and to law enforcement.

How tracing turns into a freeze is in can stolen crypto be traced.

Seized by Law Enforcement

Seizures depend on reaching the keys, the wallet or the person. They can take years.

Bitfinex: in 2022 the Justice Department seized about 94,636 BTC, worth $3.6 billion, from the 2016 hack.
Agents found the keys by decrypting a file in a suspect's cloud storage, The Block reported.
Thala, 2024: recovered the whole sum after law enforcement and crypto sleuths tracked down the hacker, per Immunefi.
Yala, 2025: Thai authorities arrested the attacker about 45 days later, and most funds were clawed back, per DefiLlama.

Recovery Scam Warning

Victims are targeted a second time. The FBI has issued repeated warnings:

August 2023: fake recovery firms "charge an up-front fee," then go silent.
August 2025: fictitious law firms target victims, "particularly the elderly," and claim government ties.
July 2026: scammers posing as FBI staff claim to have recovered victims' funds.

The FBI's IC3 says it "will never ask for payment to recover lost funds." The FTC puts it simply: if someone contacted you and asked for an upfront fee, "That's a scammer."

Red flags

A fee up front, especially in crypto or gift cards.
A guarantee you will get your money back.
Unsolicited contact after a loss, from a "law firm," "agency" or "the FBI."
Knowing the exact amounts and dates of your loss.
Requests for account numbers, personal details or your seed phrase.

As Revoke.cash puts it: "There is no legitimate recovery process that requires your seed phrase. Ever."

Instead, report at ic3.gov or to your police. In an active incident, SEAL 911 is a free, around-the-clock hotline.

The first-hour steps are in what to do when your wallet is drained.

How Guardian Helps

In the Binance theft, about $2.7 billion was frozen within hours. The sooner a theft is seen, the more of it is still freezable.

Guardian's Managed Security monitors contracts on every block, including privileged calls and large fund movements.
Its 24/7 MDR team works to a 15-minute SLA on Critical alerts.
Its security operations team reviews every multisig transaction before it is signed.

Frequently Asked Questions

What percentage of stolen crypto is recovered?

Across full years, about 8% to 16% in PeckShield's figures, and 7.7% in Immunefi's 2024 report. Quarters swing more, from 0.4% in Q1 2025 to 33% in Q3 2026, when two incidents drove the total.

Can stolen crypto be recovered?

Sometimes, in three ways: a freeze before the funds are swapped, a negotiated return, or a seizure. Issuers can freeze stablecoins. Bitcoin and ETH have no issuer, so they must be stopped at an exchange or seized.

Are crypto recovery services legitimate?

Be very wary. The FBI says private recovery companies cannot issue seizure orders, and the FTC says anyone who contacts you asking for an upfront fee is a scammer. Report to IC3 or your police instead.

Does being reimbursed count as recovery?

Not in Hacken's data. It lists operator cover separately: Bitget's fund covered $387 million in Q3 2026, but the stolen assets stayed with the attackers.

Sources

Catch the theft while funds can still be frozen

Guardian watches your contracts and fund movements around the clock, with a 15-minute SLA on Critical alerts.

Talk to Guardian Explore Managed Security