One Arbitrum multisig froze 78% of everything recovered from 2026's hacks

Good morning. Bitcoin is back above $83,000 and the whole tape is green for the first time in a week, though every major is still below where it started October. Today's lead is a number none of the morning newsletters pulled out of this year's exploit tally: more than three-quarters of everything frozen or recovered came from a single Arbitrum multisig, and the stablecoin blacklist, the tool the industry reaches for first, recovered nothing.

The tape

Bitcoin (BTC) is at $83,313, up 2.3% on the day and down 1.5% over 30 days; ether (ETH) is at $2,460, up 3.3% and down 9.7% on the month; Solana (SOL) is at $106.69, up 2.6% and down 8.0%. A relief bounce, not a trend change: every major is still below where it started October.

The movers are the better story. Convex Finance (CVX), the protocol that pools Curve voting power, is up 22.2% on the day and 32.3% on the week with no news attached. Compound (COMP), the 2020-vintage lending protocol, did $132.8 million of volume on a $255.5 million market cap: 52% of its float changed hands in a day. NEAR Protocol (NEAR) is up 11.7% on volume equal to a fifth of its market cap. Zcash (ZEC), up 12.0% and now the tenth-largest token, is today's Token talk. Starknet (STRK), the only red name, is down 29.7% on the week as Extended, a perpetuals exchange, moves its settlement off the chain.

The lead

Sixty exploits were traced between 5 January and 5 August this year, with $1.18 billion stolen. Of that, $91.2 million was frozen or recovered: $9.8 million returned to victims and $81.4 million frozen but not yet returned. And $71.0 million of the $91.2 million, 77.9%, was held by one actor: Arbitrum's Security Council, the multisig that can override the Arbitrum rollup in an emergency. Stablecoin issuer blacklists, the power of Tether and Circle to freeze USDT and USDC in any wallet, recovered $0.

The rest came from the same kind of power. Syscoin, a chain merge-mined with bitcoin, burned $9.0 million of stolen tokens at the protocol level; Stellar's largest validators refused to process $6.9 million; Volo Protocol's admin key clawed back $3.5 million; Across, a bridge, paid a $0.8 million bounty for a negotiated return. Every control that held money was a trust assumption: a council, a validator set, an admin key. A blacklist was available in 16 of the 60 incidents and used in none, and $97.2 million still sits where a named party could freeze it and has not, more than was ever frozen. Thieves rarely left time to decide: the median gap between an exploit and the first movement of funds was 17 minutes.

The strongest objection is that "blacklists do not work" is too strong, and it is: on 9 October Tether froze roughly $10 million after a phishing campaign against Ledger users, and the thieves routed into another stablecoin within a day. Blacklists are routable, not impotent; the finding is about realised recoveries, not capability. Two caveats cut against the headline. The tally excludes about a dozen incidents, mostly on Monad, so the 0.83% returned-to-victims rate flatters. And the firm that compiled it sells the monitoring it recommends, which is why the number here rests on the itemised actor table, which sums to $91.2 million on its own, and not on the report's conclusions.

What would change the view: one large blacklist recovery before year-end, or Arbitrum's council acting again, which would make this one chain's policy rather than an industry fact.

The news

• Ether Fi's buyback is customer acquisition, not supply reduction. Ether Fi (ETHFI), the liquid-restaking protocol, is spending about $225,000 a week on buybacks, 27% under its own guidance, and its distributor paid out 1.83 million ETHFI against 1.81 million bought; recipients sold 70% of it straight back. Burning or retaining shrinks a float. Pass-through is a marketing budget in token form.
• Ether staking hit a record as the ETF bid left. 43.8 million ETH is staked, 35.9% of supply, after a sixth straight quarter of inflows, while the gross yield fell to 2.63% from 2.81% and spot ether ETFs lost $320 million on the week, more than bitcoin's. Supply is locking up as the paid yield shrinks and the institutional buyer leaves; price is trading the second fact.
• The tokenisation trade has a hole in it. The week's most-cited report backs a 15-token portfolio with no bitcoin or ether, betting that stocks and Treasuries move on-chain and the fees land with the venues. Solana hosted roughly 97% of second-quarter tokenised-stock volume, $4.8 billion, and collected $28.1 million in chain fees over 30 days. The ratio that decides the trade, fees reaching tokenholders over protocol revenue, is computable for all fifteen names and published for none.
• The US settlement plumbing is tokenising 25 securities. The Depository Trust and Clearing Corporation (DTCC), which settles US equities, outlined a rollout on the Canton network and Hyperledger Besu. Canton Coin (CC), the network's token, rose 3.9% on the day, is down 11.8% on the week, and turned over 0.31% of its market cap. The institutional story keeps landing; the token keeps not reacting.

Quick alpha

• Rotation: Privacy led at +14.4% and the bar is almost all Zcash; Layer 2 trailed at +0.4% against Layer 1's +3.6%, with Starknet's drawdown inside it.
• Flows: Spot ether ETFs lost $320 million on the week while 1.99 million ETH went into staking over the quarter. The marginal seller and the marginal locker are the same asset.
• Positioning: Compound turned over 52% of its float in a day and Convex is up 32% on the week, with no story attached to either. Early or mechanical; one on-chain query separates the two. Both added to coverage today.
• Catalysts: Zcash's NU7 upgrade is slated for November: the block interval drops from 75 to 25 seconds, and legacy Sprout-pool funds become unspendable, so holders must move them first. The activation date is not yet fixed.
• Yield and points: Ether's gross staking yield fell to 2.63% from 2.81% as the staked share reached 35.9%. No new points programme worth its entry cost in today's sweep.
• Capital: Mural, a stablecoin payments company, raised a $15 million Series A led by Tether; Tether's venture arm also joined Tenstorrent, an AI chip maker, in a $1.5 billion round at a $6.2 billion valuation. October crypto venture is $436.9 million across 27 rounds through 18 October, 48% of it one bitcoin-treasury raise.

Token talk: Zcash (ZEC)

Zcash (ZEC) is a privacy coin launched in 2016 with bitcoin's supply schedule, a 21 million cap and halvings, and one difference that matters: zero-knowledge proofs let users send fully shielded transactions, with sender, receiver and amount hidden on-chain. It pays holders nothing. Like bitcoin, the token is the asset, and its value is a bet on demand for private, bearer-style money.

It is in the issue because it had the best day of any top-ten token, up 11.2% to $1,344 on $1.22 billion of volume, 5.4% of its $22.9 billion market cap. 17.0 million of 21 million ZEC are in circulation; the all-time high of $3,192 dates from October 2016, so the price is 58% below it despite a 383% gain over twelve months.

The 30-day shape is the useful part. From a 27 September peak of $1,653 the price fell 31.9% to $1,126 on 18 October; today retraces 41% of that drop, and over the full 30 days ZEC is still down 8.7% against bitcoin's 2.4%. The interest is governance rather than price: on 14 September a coinholder vote backed cutting the block time from 75 to 25 seconds and, by 98.9%, keeping the halving schedule, with about 2.4 million ZEC endorsing faster blocks and roughly two-thirds of the voting pool taking part.

What would change the view: NU7 activating cleanly in November would be the first consensus change since the vote; a slip, or trouble when legacy spends stop, would do the opposite. And one name carrying a whole sector is a concentration, not a trend.

Token Tape is written by an automated research desk built and supervised by Eric Manoukian. Figures are pulled live each morning and errors are possible. Nothing here is investment advice. The editor may hold positions in assets discussed.