CoinDesk reported that Circle and Tether froze a Bitget exploiter wallet holding about $318,000 in stablecoins after the hack, that the freeze covers only a small part of the stolen funds, and that other exploiter addresses still hold more than 63,000 ETH, which no issuer can freeze.

Circle blacklisted the address, which Etherscan labels "Bitget Exploiter 8," at 05:00 UTC Friday according to onchain data, and the wallet holds about 170.47 ETH, 218,023 USDT and 99,990 USDC.

Blockchain security firm MistTrack confirmed Tether subsequently banned the same wallet.

On the underlying breach, Bitget reported an estimated $351.6 million in unauthorized transfers from some of its wallets and temporarily suspended withdrawals, with CEO Gracy Chen saying user funds are safe and that the loss falls within the coverage of a User Protection Fund holding over $464 million.

Bitget said attackers compromised a wallet backend, spoofed transaction data and triggered the exchange's authorization process, that private keys were not compromised, and that cold wallets remained secure.

Two things have moved since the article the post is built on. First, the loss total was revised: Bitget said assets equivalent to approximately $387.50 million were transferred to attacker-controlled addresses across multiple networks, a revised figure that includes affected assets on Zcash and TRON not in the initial estimate, and withdrawals will resume in phases starting with Bitcoin on 28 September at 08:00 UTC. Second, the frozen total grew and spans more than one wallet: Bitquery recorded on 25 September at 14:34 UTC that Tether had frozen 239,113 USDT in two attacker wallets.

By Bitquery's count at 02:54 UTC on 26 September, Circle and Tether had frozen about $339,000 of USDC and USDT, and most of the stolen ETH had not moved, sitting in eight Ethereum wallets that had never sent a transaction.

On composition of the theft, a Lookonchain tally listed approximately 102.93 million XRP worth $157.5 million, 31,890 ETH worth $85.8 million, $34.75 million USDT, $21.05 million USDC, $19.67 million USDT0, 3,000 XAUt, 12,719 BNB, 821,012 AVAX and 20.59 million TRX.

XRP was the largest single loss category at roughly $157.5 million of the total.

Bitquery also recorded that 27.63 million XRP had left the attacker's accounts, mostly on its way to Bitcoin, with 75.35 million XRP still in place, and that 126.71 BTC had been paid out by 14:38 UTC on 25 September. For scale, ETH traded at $2,686.89 as of Sep 26, 2026, 6:01 pm EDT , which puts 63,000 ETH at roughly $169 million, about 44 percent of the revised $387.5 million total.