Circle and Tether freeze $318K of Bitget hack funds as $387.5M slips away

On Friday (September 25), Circle and Tether stopped nearly $318,000 in stablecoins related to the hack of the Bitget exchange, but by then most of the $387.5 million stolen in the hack had already left. This shows the usefulness, as well as the limits of asset freezes: they only work until the attackers transfer the money.

The USDC terms of Circle allow the company to restrict transfers from certain addresses. Tether has also used its own controls when working with authorities. However, neither firm can freeze Ether. After stolen assets are turned into ETH, it will be impossible to freeze it.

What issuers can and cannot freeze

Decrypt disclosed that Circle banned an address, denoted “Bitget Exploiter 8” on Etherscan at 05:00 UTC on Friday. Tether included the wallet in its USDT blacklist approximately seven hours later. In total, they froze around 99,990 USDC and 218,023 USDT.

The wallet still had nearly 170 ETH that could still be accessed. Blockchain trackers cited by Decrypt said other addresses controlled by the same hacker held another 63,000+ ETH. The suspect seemed to act fast, converting tokens that could be frozen into ETH before others could take further action.

From $351.6 million to $387.5 million

Bitget announced that its system detected unauthorized transfers from a limited number of hot wallets on September 24 at 18:31 UTC. At first, Bitget assessed the total damage to be $351.6 million but later updated the information figuring the whole amount to $387.5 million after reviewing extra Zcash and TRON transfers the first assessment did not take into account.

The exchange stated that the changes showed the full scope of the original breach and not some new theft, adding that they have contained the situation. The assets affected in this case include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX across Ethereum and other EVM networks, XRP Ledger, Zcash, and TRON.

Bitget announced that a schedule for withdrawal of funds would be confirmed by September 26, 4:00 AM UTC.

A recovery network taking shape

According to Bitget, cold wallets were not harmed, users did not experience any discrepancies in their account holdings, and the losses were to be compensated through Bitget’s User Protection Fund, which is worth more than $464 million. Mandiant and SlowMist were brought in to help with the investigation.

Bitget also expanded its recovery efforts to involve more people. Its Recovery Bounty Program gives 5% for funds frozen successfully and 5% of the amount recovered. Bitget also urged its industry partners to participate in the recovery effort. While informing the public about the incident, it revealed the addresses of the hacker, showing how exchanges, issuers and security firms now have to work together when stolen funds move across multiple chains.

Why stablecoin freezes keep coming up short

The primary issue is speed. According to Cryptopolitan’s report of April, on-chain investigator ZachXBT has alleged Circle has been unable to intercept more than $420 million since 2022. In the case of Drift Protocol, Cryptopolitan reported that Circle failed to take action for six hours while the attacker transferred more than $223 million using its CCTP bridge. Tether’s cross-chain USDT0 had been frozen around 90 minutes after the hack.

Tether has underlined its enforcement accomplishments. It reported in April that it had aided U.S. authorities in freezing over $344 million worth of USDT. Furthermore, it works with over 340 institutions all over 65 countries, helping to freeze over $4.4 billion in various assets in total. According to Tether’s CEO, Paolo Ardoino, “USD₮ is not a haven for illicit activity.”

The breach of Bitget demonstrates the pitfalls of these mechanisms: they only work when stolen funds are still available in tokens that can be frozen by issuing entities.

Stablecoins are now wired into traditional markets

As stablecoins begin to be integrated further into traditional finance, the stakes are getting higher. According to an IMF paper, a shock in stablecoin demand will impact Treasury yields in the short term and spill over into crypto and equities markets. The OECD reports that the biggest five stablecoins were estimated to be worth almost $300 billion by March 2026 and warns that stronger links between crypto and traditional finance increase cyber, consumer-protection, and illicit-finance risks.

The 2026 crypto regulation report presented by PwC shows that there will be stricter regulations on stablecoins in more than 50 jurisdictions mainly regarding reserves, redemption, governance, and operational resilience.

Regulatory pressures will just continue to increase as more major security breaches happen. As reported by TRM Labs, there have been a total of 207 hacks reported during the first half of 2026, resulting in $972 million in losses, with $643 million in losses linked to North Korean financial activities. Meanwhile, CoinGecko reported that the total loss of $3.63 billion was due to all incidents that occurred from January 2025 to July 2026, which were 245 in total. According to Decrypt, the Lazarus Group from North Korea is believed to be behind the Bitget attack, but there has been no confirmation.

In Bitget’s case, the conclusion is not that the freezing of stablecoins was ineffective. It was, but only over the funds that still could be accessed. By the time the issuer intervened, the majority of stolen funds had already been moved. As stablecoins become more and more integrated into global economies, speed may become just as important as the freezing mechanism itself.