Key Highlights
- Circle and Tether froze approximately $318,000 in stablecoins (218,023 USDT and 99,990 USDC) held in a wallet labeled “Bitget Exploiter 8” on Etherscan, linked to Thursday’s $351.6 million Bitget exchange hack.
- The frozen assets represent a small fraction of the total haul; blockchain analytics firm MistTrack confirms other exploiter addresses still hold over 63,000 ETH (valued at roughly $200 million+), which no issuer can freeze because they are native ether, not permissioned stablecoins.
- Bitget CEO Gracy Chen stated the breach stemmed from a compromised backend system in the exchange’s wallet infrastructure that allowed attackers to spoof transaction data and trigger the authorization process, ruling out a private key compromise. She confirmed the exchange’s $464 million user protection fund covers the loss.
Rapid Stablecoin Freeze by Circle and Tether
Circle moved swiftly to blacklist the Ethereum address tagged as “Bitget Exploiter 8” at 05:00 UTC on Friday, according to onchain data. The wallet contained 170.47 ETH, 218,023 USDT, and 99,990 USDC at the time of the freeze. Blockchain security firm MistTrack reported that Tether subsequently banned the same wallet, effectively immobilizing the USDT and USDC balances—totaling roughly $318,000. While the action demonstrates the ability of centralized stablecoin issuers to intervene when funds hit permissioned tokens, the vast majority of the stolen assets remain in ether, which operates without a central freeze mechanism.
Breach Mechanics: Backend Compromise, Not Private Key Theft
Bitget CEO Gracy Chen provided a technical post-mortem, explaining that attackers compromised a backend system in the exchange’s wallet infrastructure, spoofed transaction data and triggered its authorization process to move funds out. Chen explicitly ruled out a private key compromise, distinguishing this incident from typical hot-wallet private key thefts. She added that Bitget’s user protection fund, which holds over $464 million, covers the loss, aiming to reassure users that deposits remain fully backed.
Contrast with April’s Drift Protocol Incident
The response stands in sharp contrast to Circle’s handling of the April $285 million Drift hack, where the attacker moved about $232 million in USDC from Solana to Ethereum using Circle’s own cross-chain transfer protocol. At the time, critics including onchain investigator ZachXBT argued Circle could have moved faster to blacklist wallets and freeze funds. Circle maintained that it freezes assets when legally required, underscoring the regulatory and procedural constraints that govern stablecoin issuers’ intervention policies.
Why This Matters
The Bitget hack highlights the persistent vulnerability of centralized exchange infrastructure—specifically backend authorization layers—even when private keys remain secure. It also illustrates the asymmetric power of stablecoin issuers: they can neutralize a portion of stolen funds once they touch USDC or USDT, but they have no control over native assets like ETH. For the broader crypto market, the incident reinforces the importance of exchange solvency reserves and user protection funds, while reigniting debate over the speed and transparency of stablecoin freeze decisions in the absence of uniform legal mandates.
Frequently Asked Questions
- How much of the stolen $351.6 million has been frozen?
- Only about $318,000—comprising 218,023 USDT and 99,990 USDC—has been frozen. The remaining assets, primarily over 63,000 ETH held in other exploiter wallets, cannot be frozen by any issuer.
- What caused the Bitget security breach?
- According to CEO Gracy Chen, attackers compromised a backend system in the exchange’s wallet infrastructure, spoofed transaction data, and triggered the authorization process to withdraw funds. A private key compromise was explicitly ruled out.
- Will Bitget users lose funds?
- Bitget says no. The exchange’s user protection fund holds over $464 million, which CEO Gracy Chen confirmed is sufficient to cover the entire $351.6 million loss.