Stablecoin issuers Circle and Tether have frozen roughly $318,000 in stolen cryptocurrency following a security breach at Bitget, one of the cryptocurrency industry's major trading platforms.
Circle blacklisted a wallet containing 218,023 USDT and 99,990 USDC on September 25 at 05:00 UTC. Tether implemented a similar ban on the identical wallet moments later, according to blockchain security firm MistTrack. The frozen stablecoins represent a fraction of the total stolen assets.
Breach Timeline and Scope
The security incident occurred on September 24, when Bitget discovered unauthorized fund movements from several hot wallets at 18:31 UTC. According to Bitget CEO Gracy Chen, perpetrators gained access through a backend system connected to the exchange's wallet management architecture and manipulated transaction information to activate the wallet's approval mechanism. Cold wallet reserves remained untouched.
Bitget initially calculated losses at $351.6 million but revised that figure upward to $387.5 million after incorporating assets from two blockchain networks initially overlooked. The updated amount now encompasses affected holdings on Zcash and TRON. Compromised assets include XRP, ETH, USDT, ZEC, USDC, XAUt, BNB, AVAX, and TRX across four primary receiving addresses distributed across EVM-compatible networks, XRP Ledger, Zcash, and TRON.
Recovery Efforts and Bounty Program
Bitget launched a recovery bounty program offering contributors 5% of any assets they assist in freezing, plus an additional 5% for assets successfully recovered. The program solicits assistance from exchanges, security professionals, and blockchain analysts. Court-ordered or law enforcement-mandated asset freezes are excluded from bounty eligibility.
The exchange established a public monitoring dashboard for real-time tracking of stolen cryptocurrency and a submission portal for information regarding attacker wallet addresses. Bitget confirmed that Mandiant and SlowMist are assisting with the investigation and stated it has identified the attack vector and resolved the exploited security weakness.
Service Restoration
Bitget outlined a phased withdrawal restoration timeline beginning September 28 with Bitcoin transactions, followed by Ethereum-based withdrawals on September 29, USDT on September 30, and remaining tokens plus fiat currencies by October 2. The exchange emphasized that user account balances have not been impacted and referenced its Protection Fund, valued above $464 million, as the financial safeguard covering the losses.
