Circle and Tether Freeze Just 0.09% of Bitget’s $351.6M Hack
Circle and Tether have frozen stablecoins linked to the $351.6 million Bitget hack, but the intervention captures only a fraction of what attackers managed to move beyond centralized control.
Summary:
- Circle and Tether froze about $318,000 in USDC and USDT linked to the Bitget attacker.
- Other exploiter wallets still held more than 63,000 ETH after the intervention.
- The response follows criticism of Circle over its handling of April’s $285M Drift hack.
Circle blacklisted an Ethereum address labeled by Etherscan as “Bitget Exploiter 8” at approximately 05:00 UTC on September 25. CoinDesk reported that Tether had banned the same address. At the time, the wallet contained roughly 218,023 USDT and 99,990 USDC, leaving about $318,000 in stablecoins immobilized.
The same address still holds approximately 170 ETH. Across other addresses associated with the exploit, however, MistTrack was tracking more than 63,000 ETH, an asset neither Circle nor Tether can blacklist.
That imbalance offers a revealing snapshot of the hours after a major crypto theft: centralized stablecoins can become dead ends for an attacker once issuers react, while native assets such as Ether remain transferable without an issuer capable of freezing them.
Only 0.09% of the Reported Loss Was Frozen
The numbers make the limits of the intervention unusually clear.
Against Bitget’s estimated $351.6 million loss, the approximately $318,000 in frozen stablecoins represents roughly 0.09% of the total value affected.
The wallet targeted by Circle and Tether contained:
- 218,023 USDT, subsequently banned by Tether;
- 99,990 USDC, blacklisted by Circle;
- about 170.47 ETH, which remained transferable at the protocol level.
MistTrack reported that other addresses associated with the attacker collectively continued to hold more than 63,000 ETH.
The contrast is structural. USDT and USDC are centrally issued tokens whose contracts give their issuers mechanisms to block specified addresses. Ether has no equivalent company with administrative authority to blacklist an address and make its ETH unspendable.
For an attacker, the difference can determine which stolen assets remain usable once wallet addresses have been publicly identified.
The Attacker Was Already Moving Away From Freezable Dollars
That distinction helps explain activity observed immediately after the Bitget breach.
The stolen portfolio included stablecoins alongside ETH, XRP and other assets across several networks. As investigators began following the transfers, some stablecoin positions were converted into ETH through decentralized trading infrastructure.
One particularly aggressive conversion involved approximately $19.67 million of USDT0, which was used to acquire about 7,111 ETH on Arbitrum in roughly six minutes.
The trade carried no need for a bullish view on Ether. From an asset-control perspective, ETH has one crucial property that USDT and USDC do not: there is no centralized issuer capable of placing the native token itself on a blacklist.
The attacker therefore faced a narrowing window. Stablecoins offer deep liquidity and dollar-denominated value during normal trading, but those same centralized controls can become a liability once an address is associated with stolen funds.
Circle Moved Faster Than It Did After Drift
Circle’s response is also notable because it comes less than six months after the company faced criticism over another major exploit.
When Drift was hacked for roughly $285 million in April, the attacker moved approximately $232 million in USDC from Solana to Ethereum using Circle’s own Cross-Chain Transfer Protocol. On-chain investigator ZachXBT argued at the time that Circle could have acted more quickly to blacklist addresses and limit the movement of stolen funds.
The dispute exposed a difficult part of stablecoin intervention.
Circle has the technical ability to freeze USDC, but CEO Jeremy Allaire subsequently said the company requires appropriate legal authorization before freezing funds. Acting solely because an address has been publicly identified as suspicious can create legal and compliance problems of its own.
In the Bitget case, Circle’s blacklist action came within hours of the exploit becoming public, while Tether subsequently blocked the same wallet.
The amount recovered through that intervention was small, but the reaction time was materially different.
Bitget Says the Hacker Never Obtained Its Private Keys
The stablecoin freezes address what happened to some of the stolen assets after they left Bitget. They do not explain how the attacker got them out.
Bitget CEO Gracy Chen said the investigation points to a compromise inside the exchange’s backend wallet infrastructure, rather than stolen private keys. According to the company’s preliminary assessment, transaction information was manipulated before Bitget’s authorization process approved malicious transfers.
Bitget’s official notice says its systems detected unauthorized transfers at 18:31 UTC on September 24, affecting approximately $351.6 million across portions of its hot and warm wallet infrastructure. Cold wallets remained secure.
Withdrawals were temporarily suspended while deposits and trading continued. The exchange also said its separate self-custodial Bitget Wallet product was unaffected.
Bitget’s User Protection Fund held more than $464 million, which the exchange says is sufficient to cover the reported loss.
North Korea Remains a Lead, Not a Conclusion
Chen has also said characteristics observed during the investigation resemble previous operations associated with North Korean threat actors.
Bitget and outside security researchers have examined IP information, transaction routes and cross-chain activity for possible connections with DPRK-linked groups. BleepingComputer reported that Mandiant and SlowMist are among the security specialists involved in the investigation.
At this stage, however, those indicators do not amount to a publicly established attribution.
That distinction is particularly important with North Korea-linked crypto attacks because groups such as Lazarus and TraderTraitor have been associated with previous major thefts, making similarities in laundering behavior suggestive without proving that the same actors were responsible.
The $318K Freeze Shows Both Sides of Stablecoin Control
The Bitget response demonstrates why issuer-controlled stablecoins occupy an unusual position in crypto infrastructure.
The same centralized architecture criticized by some users gives Circle and Tether a capability unavailable to Bitcoin or Ethereum: stolen tokens can sometimes be rendered unusable without gaining control of the attacker’s private keys.
For victims and investigators, that creates a potential recovery mechanism.
For an attacker, it creates an incentive to leave stablecoins as quickly as possible.
The outcome of the Bitget hack illustrates both effects at once. Roughly $318,000 in USDT and USDC stopped moving once the issuers intervened, while more than 63,000 ETH across other identified wallets remained outside their control.
In a $351.6 million theft, the amount frozen is tiny. The more consequential detail is what the attackers chose to hold instead.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Kosta Gushterov
Reporter at CoinsPress
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
