Finance
“Circle and Tether froze a hacker wallet holding about $318,000 in USDT and USDC after a massive Bitget crypto heist; most of the stolen funds remain in ether, which cannot be frozen”
Plain restatementStablecoin issuers Circle and Tether blacklisted an address linked to the September 2026 Bitget exchange breach, immobilising roughly $318,000 of USDC and USDT, and the majority of the stolen value sits in ether, which issuers have no technical ability to freeze.
This post is mostly accurate. Circle blacklisted a wallet linked to the Bitget exchange breach at 05:00 UTC on 25 September 2026, holding 218,023 USDT and 99,990 USDC, about $318,000, and Tether blacklisted the same wallet shortly after, according to onchain data and the security firm MistTrack. It is also correct that stablecoin issuers can freeze only their own tokens, so ether sitting in attacker wallets is outside their reach. Two details are off. The claim that "most" of the stolen funds are in ether is a stretch: the reported 63,000-plus ETH was worth roughly $169 million at the 26 September 2026 price, against a loss Bitget revised upward to about $387.5 million, and XRP alone accounted for about $157.5 million of the theft. The frozen amount also grew: an independent onchain count put it near $339,000 across two attacker wallets by 26 September 2026. What remains unresolved is the final loss total, which Bitget says is still being traced, and whether the frozen stablecoins are ever returned. General information only, not financial advice.
Circle and Tether [drifted from the evidence:] froze a hacker wallet holding about $318,000 [drifted from the evidence:] in USDT and [drifted from the evidence:] USDC after a massive Bitget crypto heist; most of the stolen [drifted from the evidence:] funds remain in ether, which [drifted from the evidence:] cannot be frozen
[added by the neutral restatement:] Stablecoin issuers Circle and Tether [added by the neutral restatement:] blacklisted an address linked to the September 2026 Bitget exchange breach, immobilising roughly $318,000 [added by the neutral restatement:] of USDC and USDT, and [added by the neutral restatement:] the majority of the stolen [added by the neutral restatement:] value sits in ether, which [added by the neutral restatement:] issuers have no technical ability to freeze.
Red-tinted words in the claim drifted from the evidence. Green-tinted words are what a neutral restatement needs.
The trace / claim to source
- A freeze happened, and the two named issuers are the right ones. Circle blacklisted the address Etherscan labels "Bitget Exploiter 8" at 05:00 UTC on 25 September 2026 per onchain data reported by CoinDesk, and MistTrack confirmed Tether banned the same wallet afterwards.
- The stablecoin amounts match the report the post cites: 218,023 USDT and 99,990 USDC in that single wallet, about $318,000 combined as of 25 September 2026.
- A large Bitget breach preceded it. Bitget disclosed unauthorized transfers from hot wallets detected at 18:31 UTC on 24 September 2026, initially estimated at $351.6 million.
- Ether itself cannot be blacklisted by a stablecoin issuer. Circle and Tether control freeze functions in their own token contracts only, so ETH held in attacker addresses is outside their reach, as the cited reporting states.
- Large ether holdings did remain with the attacker. Reporting citing MistTrack put more than 63,000 ETH in exploiter addresses as of 25 September 2026, and an independent onchain count on 26 September found most stolen ETH had not moved.
- The post says "most of the stolen funds" sit in ether. On the figures available, ether looks like the largest single bucket rather than a majority. At $2,686.89 per ETH as of 26 September 2026, 63,000 ETH is roughly $169 million against a revised total of about $387.5 million, near 44 percent, and XRP alone accounted for about $157.5 million of the theft. "Most" overstates what the numbers support; "the largest unfreezable share" would fit them. Note this wording originates in the cited article, not with the poster.
- The $318,000 figure is a snapshot of one wallet at 05:00 UTC on 25 September 2026, presented in a post published late on 26 September as the current state. By 02:54 UTC on 26 September an independent onchain count put the frozen total at about $339,000 across attacker wallets, and Tether had acted on two wallets rather than one. The claim understates the freeze and compresses a multi-wallet action into a single one.
- The post gives no total loss figure and no date, so a reader cannot see that the theft estimate was revised from $351.6 million to about $387.5 million on 25 September 2026 after Zcash and TRON assets were counted, nor that Bitget said the loss is covered by a protection fund holding over $464 million and that withdrawals were set to resume in phases from 28 September 2026. Without the denominator, the word "most" cannot be checked by the reader at all.
- The flat statement that ether "cannot be frozen" is true at the issuer level but reads wider than the evidence. It describes what Circle and Tether can do to their own tokens. It says nothing about exchange-level interdiction, law enforcement seizure, or the freezable status of other stolen assets such as USDT on Tron or Tether's XAUt.
- Whether ether genuinely holds the majority of the stolen value cannot be settled from the retrieved sources. The 63,000 ETH figure is "more than," the attacker was swapping assets across chains, and the two tallies available (Lookonchain's 31,890 stolen ETH and MistTrack's 63,000-plus ETH held) measure different things.
- The final loss total is not fixed. Bitget has already revised it upward once and said tracing work is ongoing.
- Whether any further freezes occurred after 26 September 2026, and whether the frozen stablecoins are ultimately returned to Bitget or users, is unresolved.
- Attribution of the attack is unsettled. Bitget's CEO said some attacker IP addresses matched VPN services used by a North Korean group while calling the link uncertain, and that question is separate from this claim.
CoinDesk reported that Circle and Tether froze a Bitget exploiter wallet holding about $318,000 in stablecoins after the hack, that the freeze covers only a small part of the stolen funds, and that other exploiter addresses still hold more than 63,000 ETH, which no issuer can freeze. Circle blacklisted the address, which Etherscan labels "Bitget Exploiter 8," at 05:00 UTC Friday according to onchain data, and the wallet holds about 170.47 ETH, 218,023 USDT and 99,990 USDC. Blockchain security firm MistTrack confirmed Tether subsequently banned the same wallet. On the underlying breach, Bitget reported an estimated $351.6 million in unauthorized transfers from some of its wallets and temporarily suspended withdrawals, with CEO Gracy Chen saying user funds are safe and that the loss falls within the coverage of a User Protection Fund holding over $464 million. Bitget said attackers compromised a wallet backend, spoofed transaction data and triggered the exchange's authorization process, that private keys were not compromised, and that cold wallets remained secure. Two things have moved since the article the post is built on. First, the loss total was revised: Bitget said assets equivalent to approximately $387.50 million were transferred to attacker-controlled addresses across multiple networks, a revised figure that includes affected assets on Zcash and TRON not in the initial estimate, and withdrawals will resume in phases starting with Bitcoin on 28 September at 08:00 UTC. Second, the frozen total grew and spans more than one wallet: Bitquery recorded on 25 September at 14:34 UTC that Tether had frozen 239,113 USDT in two attacker wallets. By Bitquery's count at 02:54 UTC on 26 September, Circle and Tether had frozen about $339,000 of USDC and USDT, and most of the stolen ETH had not moved, sitting in eight Ethereum wallets that had never sent a transaction. On composition of the theft, a Lookonchain tally listed approximately 102.93 million XRP worth $157.5 million, 31,890 ETH worth $85.8 million, $34.75 million USDT, $21.05 million USDC, $19.67 million USDT0, 3,000 XAUt, 12,719 BNB, 821,012 AVAX and 20.59 million TRX. XRP was the largest single loss category at roughly $157.5 million of the total. Bitquery also recorded that 27.63 million XRP had left the attacker's accounts, mostly on its way to Bitcoin, with 75.35 million XRP still in place, and that 126.71 BTC had been paid out by 14:38 UTC on 25 September. For scale, ETH traded at $2,686.89 as of Sep 26, 2026, 6:01 pm EDT, which puts 63,000 ETH at roughly $169 million, about 44 percent of the revised $387.5 million total.
Complete reasoning
The reply is formatted for pasting into the thread where the claim is circulating.
Compact share page: finance.trueseeker.com/s/d446a55e5238/gRRFH5uX264lStRSt0ZHk-
Ask this case
Answers come only from the case file above; nothing is added.
Did Circle and Tether actually freeze funds linked to the Bitget hack?
Yes. Circle blacklisted the wallet Etherscan labels 'Bitget Exploiter 8' at 05:00 UTC on 25 September 2026, and Tether froze the same wallet shortly after, according to onchain data and the security firm MistTrack.
How much money was frozen?
The named wallet held 218,023 USDT and 99,990 USDC, about $318,000 combined, as reported on 25 September 2026. An independent onchain count later put the total frozen across two attacker wallets at about $339,000 by 26 September 2026.
Is it true that most of the stolen funds are in ether?
That is a stretch. Reported ether holdings of over 63,000 ETH were worth roughly $169 million, about 44 percent of the revised $387.5 million loss total, while XRP alone accounted for about $157.5 million, making ether the largest unfreezable share rather than a clear majority.
Why can't Circle and Tether freeze the stolen ether?
Stablecoin issuers can only freeze tokens within their own contracts, such as USDT or USDC. Ether is not their token, so they have no technical ability to blacklist it, even though it sat in the same attacker-controlled wallets.
What is still unknown about this case?
The final loss total is not settled, since Bitget already revised it upward once and said tracing is ongoing. It is also unresolved whether the frozen stablecoins will be returned and whether any further freezes happened after 26 September 2026.