- Circle and Tether blacklisted a wallet linked to the Bitget breach, locking roughly $318,000 in USDC and USDT.
- Bitget now puts the total taken on 24 September at $387.5m, revised up from $351.6m.
- Most of the stolen funds had already been swapped into ether, which no issuer has the power to freeze.
Two of the largest issuers moved against an address tied to the Bitget breach this week and between them locked about $318,000. The exchange puts the total taken at $387.5m. Both figures are accurate, and the distance between them is the story.
After an exchange is hacked, the standard reassurance is that funds are being traced and frozen. Part of the money genuinely can be. Dollar-pegged like USDC and USDT are controlled by the companies that issue them, and those companies can switch off a wallet. Ether, bitcoin and most other coins have no issuer, so nobody has that switch. Anyone told that stolen funds will be recovered is being told something true about a fraction of the money and nothing at all about the rest.
What was frozen
The wallet in question has been labelled “Bitget Exploiter 8” by trackers, one of a string of addresses the attacker moved funds through. Circle, which issues USDC, and Tether, which issues USDT, both added it to their blacklists.
A caveat on the number. The $318,000 figure comes from Decrypt’s write-up, and we have not found a statement from either issuer confirming it or a primary source we could check it against. Blacklist transactions are public, so the figure is verifiable in principle, but we are reporting someone else’s count rather than our own.
Freezing is also not the same as returning. A blacklisted balance sits where it is, unusable by the thief and unavailable to anyone else, until there is a legal process to release it. Tether has in past cases reissued frozen tokens to victims after a court order, which takes months rather than days.
Why the attacker swapped into ether
This is the mechanism readers most often get wrong, and it explains the timing.
USDC and USDT are not neutral internet money. They are liabilities of two private companies, and the behind them include a function that lets the issuer stop a specific address from moving its balance. Circle and Tether use it regularly, at the request of law enforcement or after a large theft.
Ether has no such function. There is no company behind it, no blacklist, and no administrative key that can reach into a wallet. The same is true of bitcoin. Once stolen value is sitting in either, the only route back is to catch the person holding it or persuade them to hand it over.
Which is why an attacker with $387.5m of mixed assets does not sit still. Swapping stablecoins for ether through decentralised exchanges takes minutes and needs nobody’s permission. Circle and Tether are reacting to something that has usually already happened by the time they can act.
Where Bitget’s numbers now stand
The exchange first put the 24 September hot wallet loss at $351.6m. It later raised that to $387.5m after further on-chain tracing picked up Zcash and TRON assets that had been left out of the original count, according to CryptoSlate. Exchanges and security firms have been coordinating on freezes, and a bounty has been offered for help recovering the funds.
Withdrawals were still suspended in notices issued through 25 September, while deposits and trading carried on. We covered the initial suspension when it happened, and the running thread on the breach has the sequence.
One detail sits awkwardly alongside that. On the day of the breach, the Swiss digital asset bank Sygnum said Bitget institutional assets held in segregated custody with it were unaffected. Segregated bank custody and an exchange hot wallet are different arrangements with different risk, and the people who had the first kind were never exposed to what happened to the second.
What it means for a UK holder
Money sitting on a crypto exchange has no equivalent of the Financial Services Compensation Scheme, which covers up to £85,000 per person in a UK bank. If an exchange loses customer assets, recovery depends entirely on the exchange’s own reserves, its insurance if it has any, and whatever can be clawed back on-chain.
That last part is worth sizing properly. Against $387.5m, a $318,000 freeze is under a tenth of one percent. Freezing works, it just works on a narrow slice of a portfolio, and the slice it works on is the one attackers get rid of first. If you hold coins on an exchange, our self-custody guide covers the trade-offs, and the withdrawals guide covers what to do when an exchange pauses them.
What to watch
Whether the frozen total climbs as more addresses are traced. A few hundred thousand is a rounding error; several million would suggest the attacker was slower than they looked.
And whether Bitget restores withdrawals in full, and says what it is using to cover the shortfall. A statement that customer balances are whole means very little until people can actually move them.