Bybit report: 16 major blockchains can freeze funds

The report, titled “Blockchain Freezing Exposed: Examining the Impact of Fund Freezing Ability in Blockchain,” analyzed public codebases and documentation using an AI-assisted scanner and human verification. 

Researchers grouped the tools into three types: 

1. hardcoded controls in the base software;
2. configuration-based features managed by validators or foundations;
3. on-chain methods implemented through system contracts.

Examples cited in the study include BNB Chain and VeChain for hardcoded controls. Configuration-managed features were observed on Sui and Aptos, while HECO uses contract-based mechanisms. These tools allow networks to target specific addresses or transactions during security incidents.

The lab pointed to several recent interventions. Sui froze about $162 million in assets linked to the Cetus exploit, and Aptos later introduced blacklisting capabilities. BNB Chain used hardcoded blacklists after a $570 million bridge exploit. VeChain froze tokens following a $6.6 million theft in 2019. The report notes that Cosmos’s modular account design could permit similar actions depending on how projects configure it.

Blockchain was built on the principle of decentralization — yet our research shows that many networks are developing pragmatic safety mechanisms to respond quickly to threats. At Bybit, we believe transparency builds trust. Our goal is to encourage open dialogue and better governance across the industry

– noted David Zong, head of group risk control and security at Bybit.

To detect freezing capabilities, the team scanned for features such as blacklists, transaction filters, and dynamic configuration updates, then confirmed each finding through manual review.

The study recommends that projects disclose whether and how they can intervene on-chain and proposes that transparency around emergency controls become a standard element of governance. “As crypto matures, clear and transparent safety mechanisms will help build lasting trust among users and institutions,” the report states.

According to the lab, some networks describe these functions as emergency options intended to limit further losses and assist investigations following hacks and exploits.