The execution window, quarter by quarter

The question

Between the moment an enforcement action first becomes visible on chain and the moment it takes effect, some amount of time passes. This study measures that interval and asks one thing about it: is it stable, or is it systematically closing?

That is a different question from the one most public figures answer. A cross-sectional statement — the interval is currently such-and-such — describes a single moment and then quietly stops being true. Only a series says which direction the quantity is moving, and the direction is the part that matters to anyone making a decision that has to hold for more than a quarter.

Whatever interval exists is a by-product of how an issuer happens to be governed. An issuer can take it to zero without notice. Nothing on this page is a lead time, and none should be read into it.

Definitions, fixed before the first slice

The existing public estimates of this interval disagree with each other by more than an order of magnitude, and almost all of the disagreement is definitional rather than factual — different populations, different units of count, different endpoints, different handling of the cases where nothing can be measured. Adding a sixth incompatible number to that pile would be worse than adding nothing.

So the definitions below were declared first, in full, and they did not move once the first slice was computed. If a definition turns out to be wrong, this study is republished under a new version rather than edited in place, and the old version stays readable next to the new one.

Pre-registered threshold

Declared before any slice existed, so that it could not be adjusted after seeing the data:

A fall of more than 50% in the aggregate median across eight quarters is the result that says the interval is closing.

The span is counted in quarters, not days, because the data is sliced by quarter: whether two years is 730 or 731 days depends on where it falls, and that one day can move the base into another quarter. This is published whichever way it comes out.

The clock

Both ends of every interval are block timestamps: the initiation endpoint is the block time of the earliest on-chain transaction that is a necessary precursor to the execution and names the same target, and the execution endpoint is the block time of the transaction after which the target can no longer move the asset. Neither is an observation time. Our collection latency and our uptime do not enter any figure, and two readers on two different nodes compute the same number. The endpoint definitions are the ones frozen at v1.0 on the methodology page.

What is counted

Only actions that immobilise funds enter the distribution: freezes, and destructions of a frozen balance. Releases and reversals are collected and kept out of it — mixing them in would measure two different things under one label.

Pairing

An initiation and an execution become one interval by one of two rules, applied in order:

• Exact key. Both ends carry the same identifier. One-to-one, no inference.
• Same target within a horizon. Only where no shared identifier exists: the most recent unused initiation for the same target before the execution, and only within 720 hours. Without a bound, an initiation would be paired with an unrelated execution against the same target months later, and one wrong pairing distorts the distribution more than one missed pairing.

In this series every interval was paired on an exact key; the second rule paired none.

When there is nothing to measure

An execution with no initiation it can be paired with is unobservable. It is counted, shown in every quarter, and never entered as a zero-length interval. Entering it as zero would drag every quarterly median downward and manufacture exactly the trend this study is testing for. The share of a quarter’s executions that do have a measurable interval — paired executions over paired plus unobservable — is published next to every median.

Quantiles and comparison

Quantiles use linear interpolation between order statistics (type 7 in R, the default in most statistical software), so a reader can recompute them with the tools already at hand. Intervals are assigned to the UTC calendar quarter of their execution. Comparisons are made by calendar position, not by position in a list: a quarter with no observations is simply absent, so counting back eight entries is not the same as counting back eight quarters. Durations are displayed truncated to the unit shown; ratios are computed on seconds.

Findings

The observation range closes at 2026-10-19. Within it, 3,243 executions that immobilise funds were observed; 2,547 of them were paired with their initiation into a measurable interval, and 696 had no measurable initiation. Overall, an interval could be measured for 79% of executions.

The aggregate quarterly series, for every complete quarter — the count of measured intervals, the share of that quarter’s executions that could be measured, and the median with the 25th and 75th percentiles:

Quarter	n	Measurable	p25	Median	p75
2024 Q1	140	92%	4h 25m	7h 22m	1d 2h
2024 Q2	293	95%	2h 02m	4h 49m	7h 38m
2024 Q3	328	97%	3h 23m	1d 14h	1d 17h
2024 Q4	209	92%	1h 18m	1h 28m	4h 35m
2025 Q1	207	94%	44m	1h 41m	4h 19m
2025 Q2	194	86%	2h 12m	5h 57m	15h 24m
2025 Q3	265	85%	22m	3h 00m	4h 40m
2025 Q4	243	66%	56m	3h 48m	6h 27m
2026 Q1	293	71%	0m	52m	3h 41m
2026 Q2	164	80%	28m	1h 04m	6h 20m
2026 Q3	170	40%	13m	39m	2h 04m

The 0m at the 25th percentile of 2026 Q1 is a measured value, not a missing one: in that quarter at least a quarter of measured intervals had initiation and execution in the same block.

The threshold, read two ways

At the cutoff, 2026 Q4 had run for less than three weeks. An incomplete quarter is not a smaller sample of the same thing; it is a shorter window wearing a quarter’s name, and it is not a slice of the series above. It appears once, here, because leaving out the one reading that does not cross the threshold would be choosing the convenient endpoint:

Endpoint convention	Comparison	Ratio	Thinner-end n	Threshold
Last observed quarter (2026 Q4, incomplete)	2024 Q4 1h 28m → 2026 Q4 47m	0.532	41	Not met
Last complete quarter (2026 Q3)	2024 Q3 1d 14h → 2026 Q3 39m	0.017	170	Met

On the last complete quarter, the pre-registered threshold is met. The reading that ends on the incomplete quarter does not meet it, and the two readings disagree.

The disagreement comes from the base, not the recent end. The recent medians are close — 39m for 2026 Q3, 47m for the partial 2026 Q4 — but moving the endpoint by one quarter moves the base from 2024 Q3, whose median of 1d 14h sits far above both of its neighbours, to 2024 Q4, whose median of 1h 28m does not. A single two-quarter comparison inherits whatever happened in its base quarter. That is the reason for the next table.

How much of this is the calibration

The same data, sliced a different way, is a different number. A published window figure usually does not say which two periods it compares, which makes a single such figure neither reproducible nor falsifiable. Seven calibrations of this series are set out below, so that a reader can see how much of the result comes from the data and how much from the slice:

Calibration	n	Median	Change
Full year 2024 → 2026 H1	970 → 457	6h 15m → 1h 02m	−83.4%
First half → second half of the range	1263 → 1284	5h 22m → 1h 55m	−64.3%
2024 Q3 → 2026 Q3 (threshold pair)	328 → 170	1d 14h → 39m	−98.3%
2024 Q2 → 2026 Q2	293 → 164	4h 49m → 1h 04m	−77.8%
2024 Q4 → 2026 Q3	209 → 170	1h 28m → 39m	−55.9%
2024 H1 → 2026 H1	433 → 457	6h 15m → 1h 02m	−83.4%
Earliest four quarters → latest four complete	970 → 870	6h 15m → 1h 17m	−79.3%

All 7 calibrations cross the −50% threshold, by between −56% and −98%. The only reading on this page that does not cross it is the one that ends on the incomplete quarter. The direction does not depend on the calibration; the magnitude does. The result is therefore stated as a fall of more than half under most readings, not as the largest figure in the table.

Each calibration’s exact boundaries are below. They are half-open — the start date is included, the end date is not — and each interval belongs to the period of its execution. The split between the two halves of the range is the median execution time rounded to the nearest month start, recomputed by that rule when the range was extended:

Calibration	Before	After
Full year 2024 → 2026 H1	2024-01-01 – 2025-01-01	2026-01-01 – 2026-07-01
First half → second half of the range	2024-01-01 – 2025-05-01	2025-05-01 – 2026-10-20
2024 Q3 → 2026 Q3 (threshold pair)	2024-07-01 – 2024-10-01	2026-07-01 – 2026-10-01
2024 Q2 → 2026 Q2	2024-04-01 – 2024-07-01	2026-04-01 – 2026-07-01
2024 Q4 → 2026 Q3	2024-10-01 – 2025-01-01	2026-07-01 – 2026-10-01
2024 H1 → 2026 H1	2024-01-01 – 2024-07-01	2026-01-01 – 2026-07-01
Earliest four quarters → latest four complete	2024-01-01 – 2025-01-01	2025-10-01 – 2026-10-01

A second thing is moving

Read down the “Measurable” column. In the earliest four quarters an interval could be measured for 92% to 97% of executions. Since 2025 Q4 the share has been lower and more variable, reaching 40% in 2026 Q3: a growing share of executions have no measurable initiation, and so no measurable window at all.

This is recorded rather than smoothed over. The medians above are computed only over the executions that could be measured, and a series that improves because the measurable share changed is not the same finding as one where the interval itself closed. Without this column a reader cannot tell the two apart. The aggregate share moves both with how actions are carried out and with which actions make up each quarter; this study does not decompose it.

Limitations

• Aggregate only. Every figure pools the whole study population. That is a property of the study, not a choice made after seeing the results, and it means no figure here describes any single issuer.
• The population is a defined set. It is not every enforcement action on every chain. This page describes it in aggregate terms and does not list what it includes, so the counts on this page cannot be matched one for one by a reader. A later version with a wider population is planned to list it.
• Medians cover measurable executions only. The unobservable count is published beside them for that reason; the two columns have to be read together.
• Quarterly medians are volatile. Individual quarters sit far from their neighbours — 2024 Q3 most visibly — so any single two-quarter comparison is sensitive to its base. The calibration table is the guard against reading one pair as the trend.
• The last observed quarter is incomplete. It is not part of the series and the conclusion does not rest on it. 2026 Q4 enters the series only after it closes, and the threshold is then re-read on it.
• Repeat actions are not filtered separately. Where an action against an already-restricted target takes effect on chain, it is counted like any other.
• No attribution and no judgement. The series says when actions were initiated and executed. It says nothing about who the targets are or whether any action was justified.

What this study does not publish

• Any series split by issuer, by asset, or by chain.
• Any statement about which enforcement surfaces are observed, or how well.
• Any forward-looking estimate of the interval.
• Any figure from an action that has not yet been executed.

How other people’s figures compare

Several security firms and one financial-press investigation have measured or described this interval already. They are listed under Sources with retrieval dates, as other people’s measurements: none was computed under the definitions above, and none is directly comparable with another.

One is worth quoting, not to dispute it but to show why a single number cannot settle the question this study asks. One analysis reports a median 77-minute interval over 8,310 executed actions across two chains for the period 2017–2026 (BlockSec, retrieved 2026-08-21). Taken on its own, that figure pools nine years into one median and declares no comparison period, so it says nothing about direction — it cannot be reproduced as a trend, and it cannot be placed next to any single quarter above, because it is not a comparison of two periods at all. It is a valid cross-sectional reading of its own population; it simply does not answer whether the interval is closing. That question needs a series with declared endpoints, which is the whole reason this study exists.

What this measures, and what it does not

This study is evidence that the observability boundary is moving, and it is not a promise about lead time. Two things move together in the numbers above: among the executions that still have a measurable window, the window is closing; and a growing share of executions have no measurable window at all. Read together, the window is disappearing as something that can be observed, from both ends at once.

That is exactly why the window is not something to build a decision on. Whatever interval exists is a by-product of how an issuer happens to be governed, and an issuer can take it to zero without telling anyone — including us. No lead time is offered here as typical, expected, or contractual, and none should be inferred from the figures above.

What is durable is the other side of the same measurement: who currently holds the power to freeze a given asset, whether that authority has changed, and where it can be seen at all. The honest unit of this work is not “how long is the window” but “where is the boundary, and which way is it moving” — stated as a reading, with its blind spots named, rather than as a forecast.

How to reproduce

The method is fully specified and every input is public chain data; nothing is read from us. What this version does not give you is the population: it is not listed, so applying the steps below to a population of your own choosing reproduces the method, not these exact counts.

1. For each executed action in the population, take the block timestamp of the execution transaction and of the initiation transaction it pairs with under the two rules above. An execution with no pairable initiation is recorded as unobservable, not as zero.
2. Subtract: execution timestamp minus initiation timestamp, in seconds.
3. Assign each interval to the UTC calendar quarter of its execution and compute the 25th, 50th and 75th percentiles with type-7 interpolation. The measurable share of a quarter is its paired executions over paired plus unobservable.
4. For the threshold, divide the median of the last complete quarter by the median eight quarters earlier. A ratio below 0.5 crosses it.
5. For the calibration table, apply the half-open boundaries as printed.

Each step is arithmetic on two timestamps that anyone can fetch from an archive-capable node. Collection is checked against a second, independent data source over the same block ranges, and a disagreement stops the run rather than being averaged away.

Status

Draft, held for a release decision. The series runs to 2026-10-19 and replaces the earlier reading cut off at 2026-08-21; under that cutoff 2026 Q3 was incomplete, and it is now complete. The definitions are unchanged. Until it is released, this study is shown in full and marked as pending, so that it is neither read as a live publication nor hidden as if it had no conclusions.