Circle and Tether Freeze Bitget Hacker Wallet, But Capture Little

Circle and Tether moved within hours to blacklist a wallet tied to the $351.6 million hack of crypto exchange Bitget, freezing the stablecoins it held. The gesture demonstrates that issuers can act fast when a compromised address is identified — but the amount recovered was a rounding error next to the scale of the theft, underscoring the limits of what stablecoin issuers can actually do once funds move into other assets.

What happened

The hack struck Bitget on Thursday, September 25, 2026. Blockchain security firm MistTrack traced the stolen funds to a wallet labeled “Bitget Exploiter 8,” which held 170.47 ETH, 218,023 USDT and 99,990 USDC. Circle blacklisted the address at 05:00 UTC on Friday, effectively locking roughly $318,000 in stablecoin value inside it. Tether took similar action on its side of the holdings.

That sum is a fraction of the total haul. More than 63,000 ETH remains scattered across other addresses controlled by the attackers — value that neither Circle nor Tether has any technical ability to touch, because Ether is not an asset either company issues or controls. Unlike USDT and USDC, which exist as tokens governed by smart contracts the issuers can pause or blacklist, ETH is native to the Ethereum blockchain itself, and there’s no override switch.

Bitget CEO Gracy Chen said the attackers did not steal private keys but instead exploited a backend flaw in the exchange’s wallet infrastructure, spoofing transaction data to trigger unauthorized transfers. Chen said the exchange’s user protection fund, which she put at more than $464 million, will cover the losses. Full details of how the exploit was engineered are covered in Bitget’s own account of how spoofed transfers, not stolen keys, drained the exchange.

Why the freeze matters — and why it doesn’t matter enough

The speed of Friday’s blacklisting stands in sharp contrast to how Circle handled a similar episode five months earlier. After April’s $285 million hack of the Drift protocol, the attacker moved $232 million in USDC from Solana to Ethereum using Circle’s own cross-chain transfer mechanism, and critics — including blockchain investigator ZachXBT — argued Circle was slow to respond. Circle has maintained publicly that it freezes assets only when legally compelled to do so, a policy that puts real limits on how proactively it can act even when an exploit is unfolding in plain view on-chain.

This time, the reaction was almost immediate, suggesting either a lower bar was cleared for action or that repeated criticism from incidents like Drift has pushed issuers toward faster response times when addresses are flagged by security firms like MistTrack. Either way, the pattern illustrates the two-tiered nature of on-chain enforcement today: stablecoins, because they run on permissioned smart contracts, are the one corner of crypto where a company can still reach in and stop a transaction after the fact. Everything else — ETH, BTC, most native tokens — moves according to the immutable rules of its underlying blockchain, with no central party able to intervene.

That asymmetry is precisely what made Friday’s freeze almost symbolic. Hackers who understand how stablecoin blacklisting works have every incentive to convert stolen funds into ETH or other native assets as quickly as possible, precisely to stay ahead of an issuer’s ability to act. The Bitget attackers appear to have done exactly that, leaving issuers holding a fraction of the funds while the bulk sits in assets beyond their reach.

What to watch next

Several threads from this episode are still open. Investigators and MistTrack will likely continue tracking the remaining ETH as it moves across wallets, mixers, or bridges, and any further freezes — should the funds touch a regulated stablecoin or exchange rail again — would be worth watching. Bitget’s protection fund, sized at more than $464 million, will be tested by whether it can absorb the full $351.6 million loss without affecting user withdrawals or trading operations.

The broader regulatory backdrop adds another layer. U.S. regulators have been sharpening rules for how stablecoin issuers must operate, including new capital and redemption requirements the Federal Reserve outlined this week, detailed in the Fed’s newly unveiled framework for stablecoin issuers. How quickly and consistently issuers freeze illicit funds may become part of that broader compliance conversation, especially as institutions increasingly build on tokenized infrastructure, as seen in recent moves by major banks and asset managers toward tokenized deposits and funds.

For exchanges, the incident is also a reminder that backend infrastructure — not just custody of private keys — is a genuine attack surface. Bitget’s own telling of the exploit, in which spoofed transaction data rather than a key compromise enabled the theft, may prompt other platforms to audit similar systems. Meanwhile, the contrast between April’s Drift hack and this week’s Bitget freeze gives observers a real-world case study in how issuer response times can shift under public pressure — and how much of any theft such freezes can realistically claw back.

Source: CoinDesk

This content is for informational purposes only and does not constitute financial or investment advice.