Circle and Tether Freeze $318,000 From Bitget Hack as Loss…

Circle and Tether have blacklisted a wallet tied to the Bitget security breach, immobilizing about $318,000 in stablecoins — a small share of the funds taken from the exchange. Circle blocked an Ethereum address labeled "Bitget Exploiter 8" at roughly 05:00 UTC on Friday, and blockchain security firm MistTrack later reported that Tether had also frozen the same address.

According to MistTrack, the wallet held approximately 218,023 USDT and 99,990 USDC alongside 170.47 ETH. Because USDC and USDT are issued by central entities that retain administrative control, a blacklist makes the tokens visible onchain but unusable. Ether has no equivalent issuer-level mechanism, so the ETH at the address cannot be blocked the same way.

Bitget has revised its estimate of assets sent to attacker-controlled addresses to about $387.5 million, up from an initial figure of $351.6 million, after additional tracing and classification identified previously uncounted transactions on Zcash and Tron. Bitget first disclosed unauthorized activity at 18:31 UTC on September 24. The affected assets spanned several networks and included XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX.

Recovery window narrows once funds move

CEO Gracy Chen said the attackers compromised a backend component of Bitget's wallet infrastructure, manipulated transaction data and caused the exchange's authorization system to approve fraudulent transfers. Private keys were not compromised, she said. Bitget has stated the underlying vulnerability was identified and remediated, with Mandiant and SlowMist assisting the investigation. The exchange initially suspended withdrawals while saying customer balances remained accurate and its cold-wallet infrastructure was untouched.

Circle's speed this time contrasts with its handling of the April Drift exploit, when roughly $230 million in USDC linked to the attack stayed mobile long enough to move across chains. Circle drew criticism for not blacklisting the USDC involved before much of it shifted from Solana to Ethereum. CEO Jeremy Allaire subsequently said the company's ability to freeze assets is governed by legal obligations rather than unilateral discretion.

Bitget says its User Protection Fund, valued at more than $464 million, is sufficient to cover the incident, and it has launched a recovery bounty for information or actions that lead to stolen funds being frozen or returned. The revised loss figure still sits below the fund's size, though by a narrower margin than before. Tracking cited Friday indicated other attacker-linked addresses continued to hold more than 63,000 ETH. Recovery will depend on where the remaining assets move: centralized intermediaries can potentially block funds, while native cryptocurrencies routed through self-custodied wallets or decentralized protocols are far harder to stop.