Stablecoin giants Circle and Tether moved to freeze roughly $318,000 in digital assets connected to a recent Bitget hack, but the intervention came too late to recover most of the stolen funds after the attacker had already converted the bulk of the proceeds into ether.
Issuers Blacklist Exploiter Wallet
Circle and Tether blacklisted a wallet address tagged as "Bitget Exploiter 8," a move that locked approximately $318,000 held in USDC and USDT. Both companies retain the technical ability to freeze tokens sitting in flagged addresses, a centralized safeguard baked into their respective stablecoins that has repeatedly been used to disrupt illicit activity.
The action reflects a familiar pattern in the aftermath of on-chain exploits, where stablecoin issuers step in at the request of exchanges and investigators to prevent hackers from cashing out through easily controllable assets.
Attacker Beat the Freeze
The problem for investigators is one of timing. By the time the freeze was executed, the attacker had already swapped the majority of the stolen funds into ether—a decentralized asset that neither Circle nor Tether nor any single entity can lock or claw back.
The freeze locked six figures in stablecoins, but the real loot had already vanished into ether.
That maneuver highlights a persistent weakness in efforts to recover funds from crypto thefts. While stablecoins offer a chokepoint that authorities and issuers can squeeze, converting to a native blockchain asset like ETH effectively removes that leverage, leaving only tracing and off-ramp monitoring as recovery options.
The Broader Recovery Challenge
The incident underscores how attackers have adapted to the freeze capabilities of centralized stablecoins by rapidly rotating assets into tokens that cannot be reversed. Speed is now a decisive factor in whether any portion of stolen funds can be salvaged.
Key takeaways from the episode include:
- Circle and Tether froze around $318,000 in USDC and USDT tied to the exploit.
- The attacker converted most of the proceeds into ether before the freeze landed.
- Ether cannot be frozen or reversed, limiting recovery options for the remaining funds.
For exchanges and their users, the case is another reminder that the window to act on a live exploit is measured in minutes, and that a partial freeze often means most of the damage is already done