Circle and Tether blacklisted the same wallet tied to the Bitget exchange hack on Friday, freezing roughly $318,000 in stablecoins from an exploit that drained an estimated $387.5 million. The address, labeled “Bitget Exploiter 8” on Etherscan, held 99,990 USDC and 218,023 USDT, Cointribune reported. Circle acted at 05:00 UTC Friday; Tether followed about seven hours later, according to the security firm MistTrack, via a signer confirming a transaction on its multisig wallet.
The freeze amounts to less than 0.1% of the total haul, because the attacker had already moved most stolen assets into forms no issuer can touch. The wallet also held around 170.47 ETH, which stayed untouched.
Also read: Former Tether CIO plans to sell part of stake in stablecoin issuer, report says
Key facts
- Circle blacklisted “Bitget Exploiter 8” at 05:00 UTC Friday, locking 99,990 USDC and 218,023 USDT; Tether added the same address to USDT’s blacklist roughly seven hours later, per Decrypt.
- MistTrack lists hacker addresses still holding more than 63,000 ETH, worth about $170 million, which no issuer can freeze, Cointribune reported.
- News.bitcoin reported that 102,926,478 XRP — worth $157.48 million — was sent from two Bitget wallets to a single new address in three payments on Sept. 24, and the XRP Ledger offers no tool to freeze the native asset.
- Bitget CEO Gracy Chen said attackers compromised a backend system in the exchange’s wallet infrastructure and spoofed transaction data; she ruled out a private-key compromise, per Decrypt.
- Bitget said its user protection fund, holding more than $464 million per Decrypt (reporting 5,500 BTC per News.bitcoin), will cover losses.
Most of the loot moved before issuers acted
Stablecoin freezes work only at the contract level, on the issuer’s own tokens. Ethereum’s native currency has no administrator, so the 63,000-plus ETH tied to the hack has no blacklist to land on. XRP is the same problem: News.bitcoin reported that the XRP Ledger’s freeze tools apply only to issued tokens, not to the native asset, leaving the largest single slice of the Bitget haul — the 102.9 million XRP — out of any foundation’s reach.
Cointribune reported that the attacker appears to have raced to consolidate stolen tokens into fresh wallets and swap stablecoins out within minutes. News.bitcoin noted the XRP was split into four wallets of 20 million each and a fifth holding 22,976,677 XRP, with tiny 0.00001 XRP follow-up payments from unrelated addresses — a pattern typical of address-poisoning spam.
Also read: New Hampshire rejects $100M Bitcoin bond plan; Circle wins national trust bank approval
The speed contrasted with the April Drift protocol incident, where the hacker converted funds to USDC and moved $232 million from Solana to Ethereum via Circle’s CCTP before pressure mounted on the issuer. Cointribune reported that about ten hours passed between hack detection at 18:31 UTC Thursday and Circle’s blacklist at 05:00 UTC Friday. Decrypt noted the same nine-hour gap in different terms, calling the response faster than some past incidents but also reviving debate about centralized control over permissionless assets.
Why it matters
The asymmetry between what issuers can and cannot freeze determines how much of any exchange breach is recoverable. Tether alone has blocked more than $514 million in one month, per BlockSec data cited by Cointribune, but that leverage stops at the edge of its own token. For traders, the practical question is whether the Bitget protection fund absorbs the loss and whether withdrawals resume; for the market, the continuing test is traceability rather than seizure.
What to watch
Each deposit of the remaining 63,000 ETH on a platform, or conversion into a stablecoin, opens a new interception window. Bitget has said withdrawals remain suspended during checks and that the platform will publish a complete technical report; a separate test is the roughly 400,105 XRP already moved from one wallet, flagged by onchain analyst Yfarmx as a possible test run. None of this constitutes financial advice, and crypto markets are volatile.
Reported by cointribune.com.
Sources: Cointribune, Decrypt, News.bitcoin
