Circle and Tether blacklisted a wallet connected to the Bitget exchange hack on Friday, freezing roughly $318,000 in stablecoins at the contract level while leaving a theft estimated at $387 million largely beyond recovery.

Circle acted first, adding the Etherscan-tagged address "Bitget Exploiter 8" to its USDC blacklist at 05:00 UTC Friday via the issuer's built-in freeze function. Roughly seven hours later, a Tether signer confirmed a transaction on the issuer's multisig wallet that placed the same address on USDT's deny list. Together the actions locked approximately 99,990 USDC and 218,023 USDT, per on-chain data.

The same wallet also held about 170 ETH. None of it can be frozen. Issuers can blacklist their own tokens at the contract level, but they have no authority over ether, the native asset of the Ethereum network.

How big was the breach?

Initial on-chain tallies pegged the Bitget hack at roughly $387 million, placing it among the year's largest exchange compromises. Analysts pointed to North Korea's Lazarus Group as a likely culprit based on laundering patterns, though Bitget has not named an attacker in a public filing.

Bitget CEO Gracy Chen said the breach stemmed from a compromised backend system in the exchange's wallet infrastructure, where attackers spoofed transaction data to trigger unauthorized transfers. Chen ruled out a private-key compromise, a distinction that frames the failure as operational rather than custodial. Bitget has said a user protection fund holding more than $464 million will absorb losses tied to the incident.

What can stablecoin issuers actually freeze?

The combined freeze covers a rounding error against the breach. Blockchain trackers show other addresses linked to the Bitget exploit still control more than 63,000 ETH — an amount no stablecoin issuer or centralized custodian can touch.

The shortfall reflects a familiar sequencing gap. The attacker appears to have converted freezable assets into ETH within minutes of the drain, consolidating tokens into fresh wallets and swapping stablecoins out before either issuer could intervene.

Circle and Tether can blacklist addresses, reverse transactions in cooperation with centralized exchanges, and coordinate with law enforcement. They cannot stop an attacker from routing funds through decentralized swaps into ether that no centralized party controls, nor can they reverse transactions once they clear on-chain settlement.

How fast was the response?

The seven-hour gap between Circle's blacklist and Tether's multisig confirmation ranks as faster than several past incident responses. The address tagging on Etherscan, which carries the "Bitget Exploiter 8" label, indicates at least eight distinct wallets have been linked to the same operator, with the unblacklisted wallets already cycled into ETH.

What changes next?

The episode sharpens a long-running debate about the centralized control issuers wield over assets marketed as permissionless. For Bitget, the open question is how the 63,000-plus ETH sitting in unblacklisted wallets will move through exchanges and OTC desks that now have heightened visibility into the addresses, and whether the $464 million protection fund is depleted before any further recovery takes place.