Circle and Tether have frozen a wallet connected to the Bitget exchange hack, cutting off about $318,000 in stablecoins. Even so, most of the stolen funds had already been moved out of reach before either issuer stepped in.
Circle moved first, Tether followed hours later
Blockchain data shows Circle blacklisted an address labeled "Bitget Exploiter 8" on Etherscan at 05:00 UTC on Friday, using the freeze function built into the USDC token contract.
About seven hours later, Tether took the same step. A signer on Tether’s multisig wallet confirmed a transaction that added the same address to the USDT blacklist.
Together, the two actions locked roughly 99,990 USDC and 218,023 USDT.
The ETH in the wallet was untouched
The wallet also held around 170 ETH, and that portion remains untouched. The distinction points to the basic limit of stablecoin freezes: issuers can blacklist their own tokens at the contract level, but they cannot freeze Ethereum itself.
That helps explain why so little was recovered. The attacker appears to have moved quickly to convert assets that could be frozen into ETH before the issuers intervened, consolidating stolen tokens into fresh wallets and swapping out stablecoins within minutes.
Other linked wallets still hold more than 63,000 ETH
Blockchain trackers indicate that other addresses tied to the exploiter still hold more than 63,000 ETH, well outside the authority of any stablecoin issuer.
The freezes amount to only a small recovery in what has been described as one of the largest exchange breaches of the year. The Bitget hack drained hundreds of millions of dollars, with early estimates reaching $387 million. Analysts have also pointed to North Korea’s Lazarus Group as a possible culprit.
Bitget says a backend system was compromised
Bitget CEO Gracy Chen said attackers compromised a backend system in the exchange’s wallet infrastructure and spoofed transaction data to trigger unauthorized transfers. She said the incident did not involve a private-key compromise.
The exchange has also said losses will be covered by a user protection fund holding more than $464 million.
Fast blacklisting also revived an old debate
The speed of the blacklisting drew attention as a quicker response than in some earlier incidents. At the same time, it renewed a long-running debate over the centralized control that stablecoin issuers can exercise over assets that are often traded as part of a permissionless crypto market.