The intervention immobilizes only a fraction of the stolen funds. Bitget has now raised its estimate of assets transferred to attacker-controlled addresses to approximately $387.5 million, up from its initial $351.6 million calculation after additional Zcash and Tron transactions were identified.
Why Could Circle and Tether Freeze the Funds?
USDC and USDT differ from native cryptocurrencies such as Ether because their issuers retain administrative controls that can prevent specified addresses from transferring the tokens.
When Circle or Tether blacklists an address, the tokens remain visible onchain but become effectively unusable. That feature can help law enforcement agencies, exchanges and victims recover assets after hacks, sanctions actions or court orders, but it also illustrates the centralized control embedded in fiat-backed stablecoins.
The Bitget intervention stopped approximately $318,000. Other attacker-linked addresses were still holding more than 63,000 ETH after the breach, according to blockchain tracking cited Friday. Ether has no centralized issuer capable of blacklisting the assets at the protocol level.
The contrast has become an increasingly important part of post-hack recovery. Circle has previously used its blacklist function to immobilize USDC, showing how issuer controls can alter the recoverability of stolen assets even after they leave the original platform.
Investor Takeaway
Stablecoin blacklisting can stop stolen USDC and USDT, but it offers little protection once attackers convert funds into assets such as ETH that lack issuer controls.
How Did the Bitget Attack Reach $387.5 Million?
Bitget initially said approximately $351.6 million had been transferred from portions of its hot and warm wallet infrastructure after unauthorized activity was detected at 18:31 UTC on September 24.
The exchange subsequently revised the figure to $387.5 million after completing additional onchain tracing and transaction classification. The increase reflects previously uncounted assets on Zcash and Tron rather than additional unauthorized transfers after the breach was contained.
The affected assets included XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX across several networks.
CEO Gracy Chen said the attackers compromised a backend component in Bitget’s wallet infrastructure, manipulated transaction information and caused the exchange’s authorization system to approve fraudulent transfers. She said private keys themselves were not compromised.
Bitget has since said the underlying vulnerability was identified and remediated. Mandiant and SlowMist are assisting the investigation while the exchange continues tracing assets and validating its systems.
Bitget initially suspended withdrawals after confirming the breach, while maintaining that customer balances remained accurate and that its cold-wallet infrastructure was unaffected.
Why Does Circle’s Response Stand Out?
Circle’s response is notable because the USDC issuer faced criticism following the April Drift exploit, when roughly $230 million in USDC linked to the attack remained mobile long enough for the funds to be transferred across chains.
Circle was criticized after the Drift incident for not blacklisting the associated USDC before much of it moved from Solana to Ethereum. CEO Jeremy Allaire later said Circle’s ability to freeze assets is governed by legal obligations rather than unilateral discretion.
The Bitget response was considerably faster. Yet its financial impact was limited because the exploiter had comparatively little USDC and USDT remaining at the address when the blacklists took effect.
Investor Takeaway
The speed of a stablecoin freeze matters only while stolen value remains in a controllable token. Attackers can sharply reduce that recovery window by swapping into decentralized assets.
Can Bitget Recover More of the Stolen Assets?
Bitget says its User Protection Fund, valued at more than $464 million, is sufficient to cover the incident. The exchange has also launched a recovery bounty program offering rewards for information or actions that lead to stolen funds being frozen or returned.
The revised $387.5 million estimate means the Protection Fund remains larger than the stated loss, although the margin is narrower than under the original calculation. The fund and Bitget’s proof of reserves serve different functions: the former is a corporate financial backstop, while proof of reserves addresses the backing of customer assets.
Asset recovery will depend heavily on where the attacker moves the remaining funds. Centralized exchanges, stablecoin issuers and other identifiable intermediaries can potentially block assets or assist investigators. Native cryptocurrencies transferred through self-custodied wallets or decentralized protocols are substantially harder to immobilize.
The $318,000 freeze therefore matters less for its size than for what it reveals about the recovery process: once stolen assets leave an exchange, their technical properties and the infrastructure they pass through can determine whether anyone still has the power to stop them.
