Circle and Tether freeze $318,000 of Bitget hack funds
Circle and Tether blacklisted the same wallet tied to the Bitget exchange hack, freezing about $318,000 in stablecoins from an exploit that drained an estimated $387.5 million.
Key points
- Circle blacklisted the address labelled "Bitget Exploiter 8" at 05:00 UTC Friday, locking 99,990 USDC and 218,023 USDT.
- Tether added the same address to its USDT blacklist roughly seven hours later, according to the security firm MistTrack.
- The frozen amount is less than 0.1% of the estimated $387.5 million haul, and about 170.47 ETH in the wallet was left untouched.
- MistTrack lists hacker addresses still holding more than 63,000 ETH, worth about $170 million, which no issuer can freeze.
- Bitget CEO Gracy Chen said attackers compromised a backend system in the exchange's wallet infrastructure and spoofed transaction data, ruling out a private-key compromise.
Circle and Tether blacklisted the same wallet tied to the Bitget exchange hack on Friday, freezing roughly $318,000 in stablecoins from an exploit that drained an estimated $387.5 million. The address, labelled "Bitget Exploiter 8" on Etherscan, held 99,990 USDC and 218,023 USDT, according to Cointribune. Circle acted at 05:00 UTC Friday, and Tether followed about seven hours later, per the security firm MistTrack.
The freeze covers less than 0.1% of the total haul, because the attacker had already moved most stolen assets into forms no issuer can touch. The wallet also held around 170.47 ETH, which stayed untouched. MistTrack lists hacker addresses still holding more than 63,000 ETH, worth about $170 million, which no issuer can freeze, Cointribune reported.
Stablecoin freezes work only at the contract level, on the issuer's own tokens. Ethereum's native currency has no administrator, so the 63,000-plus ETH tied to the hack has no blacklist to land on. XRP is the same problem: News.bitcoin reported that the XRP Ledger's freeze tools apply only to issued tokens, not to the native asset, leaving the largest single slice of the Bitget haul out of any foundation's reach.
Issuers freeze stablecoins
News.bitcoin reported that 102,926,478 XRP, worth $157.48 million, was sent from two Bitget wallets to a single new address in three payments on Sept. 24. The XRP was split into four wallets of 20 million each and a fifth holding 22,976,677 XRP, with tiny 0.00001 XRP follow-up payments from unrelated addresses, a pattern typical of address-poisoning spam.
Cointribune reported that the attacker appears to have raced to consolidate stolen tokens into fresh wallets and swap stablecoins out within minutes. About ten hours passed between hack detection at 18:31 UTC Thursday and Circle's blacklist at 05:00 UTC Friday. Decrypt noted the same nine-hour gap in different terms, calling the response faster than some past incidents but also reviving debate about centralized control over permissionless assets.
Bitget CEO Gracy Chen said attackers compromised a backend system in the exchange's wallet infrastructure and spoofed transaction data, and she ruled out a private-key compromise, per Decrypt. Bitget said its user protection fund, holding more than $464 million per Decrypt, will cover losses. The exchange has said withdrawals remain suspended during checks and that it will publish a complete technical report.
Assets beyond reach
The asymmetry between what issuers can and cannot freeze determines how much of any exchange breach is recoverable. Tether alone has blocked more than $514 million in one month, per BlockSec data cited by Cointribune, but that leverage stops at the edge of its own token. Each deposit of the remaining 63,000 ETH on a platform, or conversion into a stablecoin, opens a new interception window.