16 major blockchains can freeze user funds: Bybit Report
A new report by Bybit’s Lazarus Security Lab found that 16 major blockchains can freeze funds, and 19 more could do it with minor changes.
- The report found that 16 chains can freeze funds, while 19 more can easily add this function
- Major chains, including BNB, VeChain, and CHILIZ, can perform hard-coded freezing
- Some of these chains, like BNB and Sui, have already executed the freezing function
Blockchain promised to decentralize the financial system, championing absolute freedom over transactions. However, multiple major blockchains, some of which rank among the top 10 by market cap, are quietly reintroducing centralized controls.
Bybit’s Lazarus Security Lab conducted an audit of 166 blockchain networks with both AI analysis and manual review. The results showed that 16 leading networks already have fund-freezing capabilities. Among these, some can freeze accounts on the blockchain level, while others rely on validators or other means. What is more, 19 more major chains could adopt these capabilities with minimal changes to their code.
Major blockchains with account-freezing capabilities include BNB, VeChain, Sui, and Aptos. On the other hand, Arbitrum, Cosmos, Axelar, Babylon, Celestia, and Kava are among the 19 blockchains that can easily enable freezing capabilities with relatively minor protocol changes.
BNB, VeChain have already frozen accounts after hacks
Five major blockchains, BNB, VeChain, CHILIZ, VIC, and XDC, used hardcoded freezing. This means that freezing capabilities are implemented directly in the blockchain’s security code. Notably, some of them have already used this ability.
BNB (BNB) froze addresses after a $570 million cross-chain bridge hack in 2022. The second example is VeChain (VET), which added 469 hacker addresses to a public blocklist after the Foundation was hacked for $6.6M VET tokens in 2019.
Ten other blockchains, including Sui and Aptos, can freeze funds via configuration files managed by validators. These types of blacklists require a node restart to take effect.
Notably, Sui (SUI) froze $162 million after the Cetus DEX hack in 2025.
