Circle and Tether Freeze Stablecoins Tied to Bitget Hack—But Most Funds Slip Away

Circle and Tether have frozen a wallet linked to the massive Bitget exchange hack, cutting off roughly $318,000 in stablecoins from the attacker, though the bulk of the stolen fortune moved beyond reach before issuers could act.

Blockchain data shows Circle blacklisted the address, labeled “Bitget Exploiter 8” on Etherscan, at 05:00 UTC Friday, using the built-in freeze function in its USDC token contract.

Roughly seven hours later, Tether followed suit, with a signer confirming a transaction on its multisig wallet that added the same address to USDT’s blacklist. Together the actions locked about 99,990 USDC and 218,023 USDT in place.

The wallet also held around 170 ETH, but that portion remains untouched, underscoring the core limitation of stablecoin freezes: issuers can blacklist their own tokens at the contract level, but no one can freeze Ethereum itself.

That gap explains why so little was recovered. The attacker appears to have raced to convert freezable assets into ETH before issuers intervened, consolidating stolen tokens into fresh wallets and swapping stablecoins out within minutes.

Blockchain trackers indicate other exploiter-linked addresses still hold more than 63,000 ETH that no issuer has the authority to touch.

The freezes are a small dent in one of the year’s largest exchange breaches. The Bitget hack drained hundreds of millions of dollars, with early estimates reaching $387 million, and analysts have pointed to North Korea’s Lazarus Group as a possible culprit.

Bitget CEO Gracy Chen has said attackers compromised a backend system in the exchange’s wallet infrastructure, spoofing transaction data to trigger unauthorized transfers, while ruling out a private-key compromise. The exchange has said a user protection fund holding more than $464 million will cover losses.

The rapid blacklisting drew notice as a faster response than some past incidents, though it also renewed a long-running debate about the centralized control issuers wield over supposedly permissionless assets.