Stablecoin Bouncers Circle and Tether Tap a Hacker Wallet on the Shoulder 🧊

Circle and Tether have frozen a wallet linked to Thursday's $351.6 million exploit of crypto exchange Bitget, blacklisting roughly $318,000 in stablecoins that represented only a sliver of the total haul. Circle moved first at 05:00 UTC Friday, according to onchain data reviewed by Etherscan, which now labels the address "Bitget Exploiter 8." The wallet held 170.47 ETH, 218,023 USDT and 99,990 USDC before the freeze. Blockchain security firm MistTrack said Tether has since banned the same address, locking the stablecoins in place.

Most of the stolen funds remain out of reach of any issuer. MistTrack's tracker shows other exploiter addresses still control more than 63,000 ETH, an asset no centralized party can freeze. Bitget CEO Gracy Chen said attackers compromised a backend system in the exchange's wallet infrastructure, spoofed transaction data and triggered its authorization process to move funds out. She ruled out a private key compromise, and said Bitget's user protection fund, which holds over $464 million, covers the loss.

Circle's swift action stood in contrast to its response to April's $285 million Drift hack. In that case, the attacker moved about $232 million in USDC from Solana to Ethereum using Circle's own cross-chain transfer protocol. Critics including ZachXBT said Circle could have moved faster to blacklist wallets and freeze funds. Circle said it freezes assets when legally required.

The Bitget incident marks the latest in a series of large crypto exploits in 2026, and the second time this year that Circle and Tether have coordinated to block a hacker's stablecoin balance. Tether separately confirmed minimal exposure to EQIBank following an $89 million US asset seizure tied to that institution. Neither issuer commented beyond confirming the blacklisting of the Bitget-linked address.