Circle and Tether have frozen a wallet linked to the Bitget exchange hack, blacklisting approximately $318,000 in stablecoins from the attacker. However, the bulk of the stolen funds had already moved beyond reach before the issuers could act.
Circle blacklisted the address at 05:00 UTC Friday using its built-in freeze function in the USDC token contract. Roughly seven hours later, Tether followed suit, adding the same address to USDT's blacklist through a multisig transaction. Together, the actions locked about 99,990 USDC and 218,023 USDT.
The wallet also held around 170 ETH, which remained untouched. This limitation highlights a core constraint of stablecoin freezes: token issuers can blacklist their own assets at the contract level, but no one can freeze Ethereum itself.
The attacker appears to have converted freezable assets into ETH before issuers intervened, consolidating stolen tokens into fresh wallets and swapping stablecoins out within minutes. Blockchain trackers indicate other exploiter-linked addresses still hold more than 63,000 ETH that no issuer can freeze.
The Bitget hack drained an estimated $387 million, making it one of the year's largest exchange breaches. According to Bitget CEO Gracy Chen, attackers compromised a backend system in the exchange's wallet infrastructure and spoofed transaction data to trigger unauthorized transfers. The exchange ruled out a private-key compromise and said its user protection fund, holding more than $464 million, will cover losses.
Analysts have pointed to North Korea's Lazarus Group as a possible culprit. The rapid blacklisting was noted as a faster response than some past incidents, though it renewed ongoing debate about the centralized control token issuers hold over assets marketed as permissionless.
