Tether Freezes Approximately 218,000 USDT Related to Bitget Theft
On-chain data shows that Tether has frozen approximately 218,000 USDT related to addresses associated with the Bitget theft. This address is a third-hop linked address from the initial stolen wallet, which remained inactive for over 2.5 hours after being discovered. About 100,000 USDC on the same address has already been frozen by Circle.
Monitors have initiated a response timing for Circle and Tether. Circle completed its freeze 7 hours and 18 minutes earlier than Tether. Tether's action occurred on September 25 at approximately 12:19 UTC, with the address starting with 0xe07b. The attacker had exchanged part of the stolen TRX for USDT in batches, typically converting to Bitcoin within 1 to 8 minutes via Stargate or THORChain, leaving a narrow window for stablecoins; this transaction was caught due to its prolonged inactivity.
Official statistics from Bitget indicate that approximately $387.5 million in assets, including USDT, USDC, XRP, ETH, ZEC, and TRX, were transferred to the attack address. Most of these have been converted to Bitcoin or are stuck in ETH, DAI, and XRP, which the issuers cannot blacklist directly. Bitget has also offered a 5% bounty for freezing or recovering the amount. The 218,000 USDT represents less than one-thousandth of the total shortfall, highlighting that blacklisting can still be effective after three hops.
Freezing stablecoins does not change the narrative of ledger balance ownership; it merely prevents token transfers at the contract level. Assets not on the issuer's blacklist still face the next step of entering exchanges, custodians, or identifiable cross-chain protocols. On the THORChain and Bitcoin side, the freezing authority is given to nodes and counterparties, rather than Tether or Circle.
From a market mechanism perspective, the seller is the attack address splitting stablecoins for Bitcoin; the buyer is the cross-chain pool still quoting offers. The longer funds remain in USDT and USDC, the higher the probability of being hit by the blacklist. Beneficiaries are Bitget's ledger recovery and applicants for the 5% bounty; the pressured parties are those who must complete chain swaps within minutes and the channels that are paused for deposits due to blacklist misfires. Circle's proactive response speed has become a reputation, while Tether's subsequent freeze removes the USDT from the circulating inventory of the same address.
Source: Public Information
ABAB AI Insight
The 218,000 USDT is not the main battlefield of this case; it is a public timing exercise. After the attacker exchanged TRX for USDT, they typically exited within eight minutes, but this time they paused for two and a half hours, effectively handing the blacklist authority to the issuer. Circle froze USDC first, followed by Tether freezing USDT, turning the compliance counters of the two companies into a race. The amount is small, but the impact is significant: the myth of stablecoins being unfrozen does not hold after three hops.
The capital path indicates that the blacklist is the final settlement. The transfer rights of USDT and USDC are in the issuance contract, not in the holder's private key. After converting to BTC and going through THORChain, this path is closed. Bitget's 5% bounty prices the discovery of the inactivity window, while the issuer's freeze is an administrative action with zero marginal cost. In the Bybit case, the two companies had previously collaborated to blacklist, and this time they simply spread out the time difference.
Similar structures can be seen in stablecoin blacklists after mixer sanctions and selective freezes by issuers after cross-chain bridge thefts. The current phase is where the stablecoin duopoly treats response speed as a brand. Companies that can name addresses within hours turn compliance into a product; those that can only wait for press releases cannot retain stolen funds.
Structural judgments belong to the regulatory shift moving to the contract layer. Without a court order, issuers exercise freezing through blacklists. The mechanism is: the transferability of tokens is controlled by a centralized blacklist switch, and if they remain inactive beyond the tracking delay, they will be turned off. The pricing power shifts from the attacker's chain-swap speed to whoever first writes the address into the contract. The 7 hours and 18 minutes reflect poor reputation, while the 2.5 hours of inactivity is the reason for the freeze.
ABAB News · Cognitive Law
- Stablecoins that stay too long, the blacklist is harder than the private key.
- Three hops are not the endpoint; issuers can still pull the plug.
- After converting to Bitcoin, the freezing authority leaves the counter.