Bitget Lost $351.6M and Recovered $318K Before the Rest Became Unfreezable ETH

Bitget lost $351.6 million to a hot-wallet breach on 24 September. By the next day, Circle and Tether had clawed back a combined $318,000 of it. The rest is now ether, and ether does not have a blacklist function. None of it dented the market: BTC sits at $84,624, up 4.2% on the week, and Fear & Greed hasn't dropped below 70 since the breach was confirmed.

The week, quickly

• Bitget confirmed a $351.6 million hot-wallet breach; attackers moved funds across chains and swapped stablecoins for ETH.
• Circle and Tether froze $318,000 tied to the hack; the rest was already unfreezable ether.
• White-hat researchers rerouted 2.8% of a Coldcard exploit's bitcoin into a wallet tagged "Crypto Recovery Trust."
• BTC $84,624 (+4.2% week), ETH $2,690 (+1.7% week), Fear & Greed at 70.

Bitget's hot wallets drained for $351.6 million, hacker races into ETH

Bitget confirmed the breach on 24 September: several hot wallets drained, assets moved across chains, stablecoins converted into ether during rapid, back-to-back transactions. That is the entire public record so far. No breakdown of which wallets, no confirmed attack vector, no word yet on whether reserves or an insurance fund cover the gap. I don't have Bitget's own postmortem, and until one exists, any claim beyond the headline number is a guess.

Why it matters: $351.6 million is large enough to test whether an exchange this size can absorb the loss without touching user balances. That question is entirely unanswered right now, and the size of the number is the only fact anyone outside the company has to work with.

What to watch: whether Bitget publishes proof-of-reserves or a repayment timeline, and whether the exploiter's ether starts moving toward a centralized exchange — the point at which it would surface in a whale feed.

Circle and Tether freeze $318,000 of the haul; the rest is already ETH

Circle and Tether blacklisted a wallet labelled "Bitget Exploiter 8" on 25 September, locking roughly 99,990 USDC and 218,023 USDT — about $318,000 combined. Decrypt and CoinDesk reported the identical figure independently. By the time the freeze landed, the attacker had already converted most of the stolen funds into ETH.

Why it matters: the freeze worked exactly as designed and still caught less than a tenth of one percent of the haul. Stablecoin issuers can only act on their own rails. The moment stolen funds leave USDC or USDT for a native asset, that lever disappears entirely — not weakened, gone. For someone holding funds on an exchange, the lesson isn't really about ether. It's that a security backstop sitting three steps removed from your own custody only helps if the thief is slow enough to still be inside it when it fires. This one wasn't.

What to watch: whether the exploiter's ETH lands on a centralized exchange, the only remaining chokepoint, or moves through a bridge first. Full analysis on Siade Whales.

White-hat hackers reroute 2.8% of a Coldcard exploit into a 'recovery trust'

Galaxy Research says white-hat actors consolidated bitcoin tied to a Coldcard exploit into a fresh address tagged "Crypto Recovery Trust." The amount moved is 2.8% of the total haul. The other 97.2% is wherever the original exploiter left it.

Why it matters: Coldcard is built for cold storage — keys generated and signed offline, on hardware that isn't supposed to be the weak point. An exploit against it is an exploit against that specific assumption, and 2.8% recovered is not recovery, it's a rounding error with a name attached. It says nothing about whether the vulnerability behind it is closed.

What to watch: whether Coldcard's maker names the affected firmware version, and whether the recovery address collects more than its current 2.8% in the coming days.

The week in numbers

• BTC $84,624, up 4.2% on the week, up 8.7% over 30 days — price held through a $351.6 million exchange hack without flinching.
• ETH $2,690, up 1.7% on the week, up 10.1% over 30 days — the same asset the Bitget hacker chose to hide the stolen funds in.
• Total market cap $3,068.89B; BTC dominance 55.1%, ETH 10.7%.
• Best of the top 20 over 7 days: LINK +14.2%, ADA +14.0%, DOGE +10.5%. Worst: TRX -0.3%, HYPE -0.4%, XMR -3.0%.
• Fear & Greed at 70, and it never dropped below 70 all week — 71, 70, 78, 71, 71, 71, 74, 70. Sentiment stayed in Greed straight through the hack headline.
• Whale moves of $25M or more: 5 in the last 168 hours, $195.5M total, $56.4M into exchanges against $50.0M out. A $6.4M net tilt toward exchanges — too small to call a trend, but it's the one number here you can check against your own addresses instead of a mood index.
• BTC liquidations over 7 days: $104.9M in longs, $226.6M in shorts. Shorts paid for betting against a week that closed green.

What to watch this week

• Whether Bitget discloses proof-of-reserves or a plan to cover the $351.6 million gap.
• Whether the Bitget exploiter's ether moves onto a centralized exchange, the only place left where it could still be frozen or flagged.
• Whether Coldcard's vendor confirms the exploit and the recovery address grows past 2.8%.
• Whether Fear & Greed holds above 70 if BTC and ETH stall, or whether the long-short liquidation imbalance flips.

An exchange balance is a claim on a company, not a claim on a blockchain — Bitget's users are relearning that this week, at $351.6 million. Siade Whales tracks whale flows and wallet exposure against public addresses, so an unusual move shows up on your own screen rather than in someone else's breach notice.