- Trending
- Comments
- Latest
The Bitget hacker sent 847.26 BTC, worth $63.43 million, into CoinJoin transactions between November 6, 2026 and November 11, 2026, Arkham reported. That was most of the 1,052.34 BTC ($78.61 million) that left the wallets it labels over those six days.
Arkham traced 847.26 BTC, accounting for approximately 80.5% of the Bitcoin transferred. The movements follow the September 24 breach of Bitget, whose revised calculation put the total value of transferred assets at $387.5 million.
The latest figures describe movements from tracked wallets. They do not establish that the transferred Bitcoin was sold or converted into cash.
The daily transfers varied considerably before rising sharply towards the end of the reporting period.
On November 6, 137.71 BTC worth $10.47 million left the labelled wallets. Another 156.04 BTC, valued at $11.86 million, moved the following day, before activity fell to 16.75 BTC worth $1.27 million on November 8.
Outflows then increased to 206.31 BTC on November 9 and 238.79 BTC on November 10. By 11:58 UTC on November 11, the total for that day had reached 296.74 BTC, worth $21.83 million.
That final figure was more than double the November 6 amount, despite the reporting cutoff falling before midday UTC. Across the six days, Bitget hacker wallets recorded average outflows of 175.39 BTC, approximately $13.10 million, per day.
The activity follows earlier movements documented in October. Arkham previously tracked $19.48 million leaving the wallets between October 21 and October 24, with almost all of it going to new addresses. At that stage, the firm had not identified an exchange or mixer as the recipient.
Most of the latest Bitget hacker transfers entered CoinJoin transactions, which combine Bitcoin inputs from multiple participants and make direct links between inputs and outputs harder to establish.
“847.26 BTC ($63.43M) of it entered CoinJoin transactions,” Arkham said in its update on X.
The firm identified 66 such transactions beginning at 09:27 UTC on November 6. Of the Bitcoin reaching them, 579.80 BTC worth $43.59 million came directly from labelled wallets.
Another 267.46 BTC, valued at $19.84 million, passed through fresh addresses over one to six hops before entering CoinJoin. Direct transfers therefore represented approximately 68.4% of the Bitcoin traced into those transactions.
The source cited WabiSabi protocol documentation describing how participants can combine inputs and create outputs without revealing a direct input-to-output relationship to the coordinator or other participants.
Earlier analysis had identified similar Bitget hacker activity on a smaller scale. In September, AMLBot traced approximately four BTC into CoinJoin after following funds through TRON, USDT0, Ethereum and THORChain. AMLBot characterised that route as an apparent attempt to obscure stolen assets.
Arkham separately classified 205.08 BTC, worth $15.18 million, as transferred but not CoinJoined.
Within that category, 172.33 BTC worth $12.72 million remained unspent across 250 addresses. Another 16.38 BTC, valued at $1.22 million, was still moving after six hops.
The breakdown also identified 10 BTC worth $760,000 sent to Maya Protocol and 4.37 BTC worth $330,500 distributed across 433 small outputs.
Despite the outflows, Bitget hacker wallets continued to hold a substantial balance at the latest snapshot.
“The wallets still hold 959.29 BTC ($71.44M),” Arkham said.
Bitcoin accounted for more than 99% of the approximately $71.86 million portfolio shown in the accompanying dashboard. Other listed assets included 241,026 USDT, 134,456 USDC and 18.358 ETH, alongside smaller TRX and USDD holdings.
The dashboard classified approximately $339,320 of the portfolio as frozen and $71.52 million as liquid. Those categories describe the tracked holdings; they do not indicate that the liquid balance has been recovered by the exchange.
The Bitget hacker movements come as the exchange maintains a programme offering rewards for eligible assistance with freezing and recovering stolen funds.
Bitget offers 5% of funds that participants directly help freeze and a separate 5% of funds they directly help recover. The company determines eligibility, assesses contributions and decides payments.
Actions taken under court orders, law enforcement requests or other legal processes are excluded from the programme.
The exchange initially valued the September breach at $351.6 million, later revising the transferred-assets total to $387.5 million. It said the adjustment included Zcash and TRON assets omitted from the initial calculation and did not represent additional unauthorised withdrawals.
Bitget named Mandiant and SlowMist as investigation partners in its September notice and said it had identified and fixed the underlying vulnerability.
Arkham’s latest tracing shows the Bitget hacker continuing to move substantial amounts of Bitcoin, with CoinJoin accounting for most recorded outflows. A sizeable balance remains in labelled wallets, but the update does not announce a new recovery.
Copyright © 2025 - The Bit Gazette.
