Key takeaways
- Bitget has revised the loss upward to roughly $387.5 million, from an initial estimate near $351.6 million, as token accounting widened to include Zcash and TRON assets. Withdrawals remain paused.
- Circle and Tether blacklisted a wallet labelled "Bitget Exploiter 8", locking about $318,000 in USDC and USDT — roughly 0.08% of the total stolen.
- The attacker had already swapped the majority into ether, which no issuer can freeze, because ETH is the network's native asset rather than a token controlled by a company.
- Bitget's CEO says the fingerprints resemble a DPRK-linked group. The attack reportedly worked by faking internal transfer requests rather than by breaking cryptography.
Two numbers from the Bitget breach are worth putting side by side.
The total stolen has been revised upward to roughly $387.5 million, from an initial estimate near $351.6 million, as the exchange widened its accounting to include Zcash and TRON assets. XRP and ether dominate the identified outflows. Withdrawals are still paused.
The amount Circle and Tether managed to freeze: about $318,000.
That is roughly eight hundredths of one percent. The gap between those two figures explains more about how this market actually functions than most analysis of the hack itself.
Why stablecoins can be frozen at all
Start with the part that surprises people who assume crypto is uniformly uncensorable.
USDC and USDT are tokens issued by companies — Circle and Tether. Those companies wrote the contracts, and the contracts contain a blacklist function. When an issuer adds an address to it, the tokens at that address stop being transferable. They still exist on the ledger; they simply cannot move.
This is not a flaw. It is a deliberate design decision, and it is arguably necessary — an issuer redeeming tokens for real dollars operates under anti-money-laundering obligations, and regulators expect the ability to act on stolen or sanctioned funds.
But it means something specific that is worth being clear-eyed about: a centralised stablecoin is not a bearer asset. Holding it does not give you unconditional control. You hold it at the issuer's discretion, and that discretion is real, exercisable, and has been exercised here.
Why it did not work
The blacklist requires two things the attacker denied them: identification and time.
Analysts must first identify which addresses hold stolen funds. Then the issuer must verify and act. That process takes time measured in hours. A competent attacker moves in minutes.
Which is exactly what happened. The funds were swapped into ether before the freeze landed. And ETH cannot be frozen by anyone, because it is not a token issued by a company — it is the native asset of the network itself. There is no contract with a blacklist function, no issuer, nobody with the authority to act.
Understanding this distinction is genuinely useful, and it generalises well beyond this incident:
- Issued tokens — USDC, USDT and most tokens on a network — can be frozen by whoever controls the contract.
- Native assets — BTC on Bitcoin, ETH on Ethereum — cannot be frozen by anyone.
Sophisticated attackers know this precisely. The swap into ether was not luck; it is the standard first move, and it is why freezing recovers a rounding error rather than a meaningful share.
The attack itself
According to reporting, the attacker drained the hot and warm wallets by faking internal transfer requests.
That detail matters. No cryptography was broken. No private key was guessed. The system was persuaded that legitimate internal instructions were arriving, and it acted on them.
This is how most large exchange losses now happen. Not by defeating mathematics, but by compromising the process around it — an employee's credentials, a signing workflow, an internal approval system. The cryptography holds. The organisation around it is what gets breached.
Bitget's CEO has said the fingerprints resemble a DPRK-linked group. That remains a preliminary attribution, and infrastructure-based attribution is among the easiest to get wrong. But if state-linked teams are the adversary, this is a structural problem rather than a lapse by one operator. Well-resourced, persistent groups working full-time against systems that must stay online to function is a materially harder problem than sloppy security.
What this means for you
Three practical conclusions, none of which are about Bitget specifically.
Do not count on funds being recoverable. The freeze mechanism exists and it works, but against a competent attacker it recovers a fraction of a percent. Any mental model where "they can just freeze it" provides comfort should be revised downward considerably.
Understand what you hold. If you hold USDC or USDT, you hold an issuer-controlled token. That brings real benefits — regulatory compliance, redemption obligations, and the Federal Reserve's proposed capital and two-day redemption rules would strengthen them further. It also means the issuer can freeze your address. Both are true, and the trade-off is a reasonable one, but it should be a choice rather than a surprise.
The exchange lesson has not changed. A balance on a trading venue is a claim against that venue. Hold there what you are actively using, keep the rest where you control the keys. Withdrawals at Bitget have now been paused for days, which is the practical demonstration of what that claim is worth when something goes wrong.
Meanwhile, tokenisation kept moving
Largely unnoticed under the hack coverage, Aave expanded its V4 lending market on Base to accept Coinbase tokenized stocks as collateral. Seven US technology stock tokens can now back USDC loans for eligible users outside the United States.
That is a genuinely notable step. It is the first widely visible case of tokenised equities being used as collateral in a DeFi lending market — the thing tokenisation advocates have described for years, now actually running. The SEC's conditional exemption for tokenised NMS stock earlier this month was the regulatory half; this is the plumbing half.
Worth watching carefully rather than celebrating. Equity collateral in an automated liquidation system introduces a new question: what happens when the underlying stock market is closed and the lending protocol is not? Traditional markets have circuit breakers and trading halts. Lending protocols liquidate continuously. Those two designs have not previously had to coexist.
The market
Bitcoin is around $83,980, down slightly on the day but still up roughly 4% over the week. Ether is near $2,693. The Fear and Greed Index remains at 71, in Greed. The $15.6 billion options expiry passed without dramatic effect, which is usually how these resolve despite the coverage they attract beforehand.
XRP and Solana have continued climbing while Bitcoin consolidated — the kind of divergence that gets read as rotation, though a few days of relative strength is a thin basis for that conclusion.
The short version
$387.5 million left an exchange. $318,000 was frozen. The difference is that stolen stablecoins can be locked and stolen ether cannot, and attackers know which is which before they start.
If there is one thing to carry from this, it is the distinction between an issued token and a native asset. It determines who can stop your money moving, and almost nobody checks which one they are holding.
Frequently asked questions
How can Circle and Tether freeze stablecoins at all?
USDC and USDT are tokens issued by companies, and those companies wrote the smart contracts. The contracts include a blacklist function: when an issuer adds an address to it, tokens at that address can no longer be transferred. This is deliberate design rather than a flaw — issuers redeem tokens for real dollars and operate under anti-money-laundering obligations, so regulators expect them to be able to act on stolen or sanctioned funds.
Why could they only freeze $318,000 out of $387 million?
Two reasons. Freezing requires analysts to identify the addresses and the issuer to verify and act, which takes hours, while a competent attacker moves in minutes. More fundamentally, the attacker swapped most funds into ether, and ETH cannot be frozen by anyone because it is the native asset of the Ethereum network rather than a token controlled by a company. There is no issuer and no blacklist function.
What is the difference between an issued token and a native asset?
A native asset is the base currency of its own network — BTC on Bitcoin, ETH on Ethereum. Nobody issues it and nobody can freeze it. An issued token, such as USDC, USDT or most tokens, exists as a smart contract that somebody controls, and that party can generally freeze balances. It is worth knowing which category anything you hold falls into, because it determines who can stop it moving.
How was the exchange actually breached?
Reporting indicates the attacker drained hot and warm wallets by faking internal transfer requests. No cryptography was broken and no private key was guessed — the system was persuaded that legitimate internal instructions were arriving. This is how most large exchange losses now occur: the mathematics holds, and the organisational process around it is what gets compromised.
What is significant about tokenized stocks on Aave?
Aave expanded its V4 market on Base to accept Coinbase tokenized stocks as collateral, letting seven US technology stock tokens back USDC loans for eligible users outside the US. It is the first widely visible case of tokenised equities being used as DeFi collateral. The open question is what happens when the underlying stock market is closed while the lending protocol continues liquidating — traditional markets have halts and circuit breakers, lending protocols do not.
Sources
- Circle and Tether Freeze Stablecoins Tied to Bitget Hack—But Most Funds Slip Away
- Bitget Hack Losses Climb to $387M: Here's What Happened, and Why North Korea Is a Suspect
- Bitget Raises Hack Estimate To $387.5 Million As Token Accounting Widens
- AAVE Price Surges as Coinbase Tokenized Stocks Launch on Aave V4 Base
- Bitcoin Rally Slows as $15.6 Billion Options Expiry Hits
Not financial advice. Crypto assets are volatile and unregulated in many jurisdictions. In India, gains are taxed at 30% with 1% TDS on transfers. Do your own research and never invest money you cannot afford to lose.
Editorial note: Crypto Shakti uses an AI-assisted research and drafting workflow. Every article is grounded in the linked primary sources and live market data captured at publication time.