Bitget hack sees stolen USDC swapped for ETH, raising questions on Circle’s freeze policy

Bitget disclosed a breach on September 24 that it estimates cost about $351.6 million. The attacker moved USDC from the exchange’s hot wallets and later swapped the stablecoin for ETH, reigniting debate over Circle’s ability to block stolen USDC.

Attack timeline and immediate response

At 18:31 UTC on September 24, Bitget’s security systems flagged unauthorized transfers from several hot wallets. The exchange halted customer withdrawals, kept deposits and trading open, and reported that its cold wallets remained secure. Bitget said investigators believe the attackers accessed internal systems directly, without using customer withdrawal requests.

On‑chain movement of stolen assets

On‑chain tracking shows the stolen portfolio included roughly 21 million USDC, 102.93 million XRP and 31,890 ETH, valued at about $356.8 million at the time of analysis. Security researcher Taylor Monahan highlighted the USDC transfers on X, noting that the funds were quickly moved into ETH, which cannot be frozen by Circle once the swap is completed.

Circle’s freeze policy under scrutiny

Circle’s USDC terms state that the issuer may block transfers to or from addresses when legally compelled or when it determines the address is linked to illicit activity. Critics argue the company’s response time is too slow during live exploits. Circle maintains that it only freezes tokens when it receives a valid legal order and that faster intervention requires clearer legal frameworks.

Historical context and similar cases

On‑chain investigator ZachXBT has documented at least 15 prior incidents since 2022 where Circle allegedly acted slowly, involving more than $420 million in suspected illicit USDC flows. Notable examples include the July 2025 GMX hack, the Cetus hack, and the Drift Protocol exploit, where stolen USDC was converted to ETH before any blocklist action.

Legal developments

A U.S. civil lawsuit filed in Massachusetts after the Drift exploit alleges Circle failed to stop roughly $230 million in stolen USDC. The plaintiff points to Circle’s ability to freeze addresses in other cases as evidence that faster action was possible, though no court ruling has yet been issued.

Implications for stablecoin users

The Bitget incident underscores the challenge of protecting stablecoin holders when attackers can quickly convert USDC into other assets. Until legal mechanisms for rapid, coordinated freeze actions are clarified, stolen USDC may remain movable even after blocklisting attempts.