(SeaPRwire) –
By: Oliver Hawthorne
Bitget announced $387.5 million was stolen from its platforms. The numbers climb upward because the initial estimate missed entire networks. That is a painful fact to swallow. What matters more is what happened next. Circle and Tether froze roughly $318,000 in combined stablecoins. It sounds like rounding error on a loss that size. It is actually the entire point of this story.
The exchange says cold wallets stayed secure. That statement survives scrutiny only if you accept a very narrow definition of cold storage. Hot and warm wallets were compromised on September 24 at 18:31 UTC. The CEO admitted attackers spoofed transaction data to trigger wallet authorization. No private key was stolen. The backend system tied to wallet infrastructure was the entry point. That distinction matters more than most readers realize. Circulating narratives about cold storage safety collapse the moment infrastructure sitting one layer above keys gets hijacked.
Bitget offered a bounty program offering five percent for freezing funds and another five percent for recovering them. The exchange opened a public dashboard tracking stolen assets. Investigators from Mandiant and SlowMist are involved. The company fixed the vulnerability and said no further unauthorized transfers are possible. Withdrawals restart in phases starting September 28 with Bitcoin, then Ethereum network tokens, USDT, and other assets through October 2. Customer balances remain unaffected according to the exchange. A Protection Fund valued at over $464 million will cover the gap, though no updated valuation has been issued.
Meanwhile, MistTrack reported attacker-controlled addresses still hold more than 63,000 ETH. That figure dwarfs the frozen stablecoin amount. Ether cannot be frozen by any single company. The structural difference between what the issuers controls and what they cannot touch is stark. Stablecoins became the only levers available after the hack. Every address Circle and Tether blacklisted reduced attacker liquidity. Every dollar frozen this way represents centralized intervention in a system that markets itself as immutable.
The list of affected assets stretches across XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX. Four main receiving addresses were identified across EVM-compatible networks, the XRP Ledger, Zcash, and TRON. Some stolen USDC was converted into ETH during movement, according to researcher Taylor Monahan. The attack path ran through multiple chains before landing in convertible forms that escape issuer control.
Bitget CEO Gracy Chen is scheduled to host a live Q&A session on September 28 at 07:30 UTC. The exchange says it found the original attack vector and closed it. The timeline of recovery actions is compressed and aggressive. Phased withdrawal restoration begins within days. That pace suggests the company understands public trust operates on a shorter clock than forensic investigation.
The real question here is not whether Bitget can recover or whether the vulnerability is patched. The question is what this incident reveals about centralized exchange security architecture. When an issuer can freeze funds tied to a named attacker address, that issuer becomes both infrastructure provider and gatekeeper. The same power that enables rapid response also defines exactly who benefits from that response. Stablecoin dominance in recovery efforts makes this dynamic visible. ETH holdings escaping that mechanism do not.
The industry has spent years building narratives around self-custody and decentralization. This hack does not destroy those narratives. It exposes where they carry the most risk. Funds in cold storage that stay cold do not face this problem. Funds routed through backend systems that authorize transactions get exposed to something far more mundane. Spoofed data. Compromised infrastructure. A single point of failure inside an exchange architecture.
Circle and Tether moved quickly. Their actions were visible and measurable. But the scale of what they could freeze relative to what escaped their control tells a simpler story. The stablecoin issuers proved they hold real power over digital settlement. That power exists independently of any exchange’s security posture. Bitget may have lost nearly four hundred million dollars. The market lost something harder to quantify. The illusion that crypto infrastructure and traditional financial oversight operate as separate worlds just dissolved.
Author bio: Oliver Hawthorne is a Principal Correspondent permanently stationed at an international technology review, covering crypto infrastructure, exchange security, and the collision of decentralized protocols with centralized control mechanisms.