In a decisive response to one of the most significant cryptocurrency thefts of the year, the two leading stablecoin issuers, Circle and Tether, have taken coordinated steps to freeze a wallet that was identified as belonging to the hacker responsible for the Bitget exchange heist. The incident, which unfolded in early September 2024, saw attackers siphon a staggering amount of digital assets from Bitget, a major cryptocurrency trading platform that serves millions of users worldwide. While the majority of the stolen funds were transferred into Ether (ETH), a cryptocurrency that operates on a decentralized blockchain and cannot be directly frozen, a substantial portion—approximately $318,000—was moved into stablecoins issued by Circle’s USDC and Tether’s USDT.
These stablecoins, unlike Ether, are issued by centralized entities that retain the ability to blacklist addresses and effectively render them unusable on compliant platforms. The Bitget breach was first reported when the exchange’s security team detected irregular outbound transactions that bypassed the platform’s normal withdrawal limits.
Preliminary forensic analysis traced the flow of assets through a complex web of mixers, tumblers, and cross‑chain bridges, designed to obscure the origin and destination of the funds. Within hours, the attackers had moved roughly $150 million worth of crypto into a series of wallets, many of which were newly created and had no prior transaction history. The rapid movement of funds raised alarms across the crypto community, prompting immediate investigations by both private security firms and law‑enforcement agencies. Circle and Tether’s intervention focused specifically on the stablecoin component of the theft.
Because USDC and USDT are issued on multiple blockchains—including Ethereum, Solana, and Tron—the issuers maintain a list of sanctioned addresses that are prohibited from receiving or sending their tokens on compliant platforms. By adding the hacker’s wallet to this blacklist, Circle and Tether effectively prevent any exchange, wallet provider, or DeFi protocol that respects the blacklist from processing transactions involving the frozen address. This means that while the hacker can still hold the assets on the blockchain, they cannot move them into mainstream services that enforce the blacklist, dramatically reducing the liquidity and utility of the stolen stablecoins. The decision to blacklist the wallet was not taken lightly.
Both companies have historically been cautious about using blacklisting as a tool, given concerns about over‑reach and the potential for mistakenly freezing legitimate users’ assets. However, the sheer scale of the Bitget theft, coupled with the clear evidence linking the wallet to illicit activity, prompted a rare coordinated action. In a joint statement, Circle’s Chief Compliance Officer emphasized that the move aligns with the companies’ broader commitment to protecting users and preserving the integrity of the stablecoin ecosystem.
Tether’s spokesperson echoed these sentiments, noting that the blacklist is part of a “multi‑layered approach” that includes cooperation with law‑enforcement, real‑time monitoring, and ongoing enhancements to anti‑money‑laundering (AML) protocols. It is important to understand why the stablecoin portion of the stolen assets can be frozen while the Ether cannot. Ether, like most native blockchain tokens, is governed by the underlying protocol and does not have a central authority that can intervene in its transfer.
Once ETH is on the blockchain, it can be moved freely by anyone who possesses the private key to the address. In contrast, USDC and USDT are tokenized representations of fiat currency that rely on centralized entities to issue, redeem, and manage the supply.
These entities retain the technical capability to enforce compliance rules, such as freezing or blacklisting addresses, through smart‑contract logic that checks against an internal list before allowing transfers. The impact of the blacklist is already being felt across the market. Several major exchanges, including Binance, Coinbase, and Kraken, have announced that they will automatically reject any transaction involving the flagged wallet.
Decentralized finance (DeFi) platforms that integrate with the issuers’ compliance APIs are also expected to block the address, effectively cutting off a major exit route for the hacker. Analysts predict that the loss of liquidity will force the attacker to either hold the assets in a dormant state or attempt to convert them through less regulated channels, such as peer‑to‑peer trades or private OTC deals that do not enforce the blacklist. While the freezing of $318,000 in stablecoins represents a relatively small fraction of the total amount stolen, it sends a powerful message to the broader crypto community. It demonstrates that centralized stablecoin issuers are willing to take concrete action against illicit activity, even at the risk of controversy.
Moreover, the move may encourage other issuers and service providers to adopt similar measures, creating a more resilient defensive layer against future hacks. The Bitget incident also underscores the ongoing challenges faced by cryptocurrency exchanges in safeguarding user funds.
Despite employing advanced security measures—such as multi‑signature wallets, hardware security modules, and real‑time anomaly detection—exchanges remain attractive targets for sophisticated threat actors who exploit vulnerabilities in smart contracts, supply‑chain dependencies, or human error. In the aftermath of the theft, Bitget has pledged to reimburse affected users to the extent possible, while also launching a comprehensive review of its security architecture. Law‑enforcement agencies, including the U.S.
Department of Justice and Interpol, have opened parallel investigations. They are working closely with blockchain analytics firms to trace the remaining Ether and identify any potential points of convergence where the hacker might attempt to cash out. The collaboration between private sector entities like Circle and Tether and public authorities highlights a growing trend of public‑private partnerships aimed at combating crypto‑related crime. In summary, the coordinated blacklisting effort by Circle and Tether marks a significant milestone in the fight against cryptocurrency theft.
By leveraging their unique ability to freeze stablecoin assets, the issuers have effectively limited the hacker’s ability to liquidate a portion of the stolen funds, while also reinforcing the importance of compliance and cooperation across the industry. Although the majority of the stolen assets remain in Ether—an untouchable asset under current blockchain governance—the restriction on USDC and USDT will likely complicate the attacker’s plans and may ultimately aid in the recovery of at least part of the lost capital.
The episode serves as a stark reminder of the evolving threat landscape in digital finance and the critical role that both centralized and decentralized actors must play to protect users and maintain trust in the ecosystem.