.png){kind=logo}
The Bitget hacker transferred USD 78.61 million in Bitcoin from wallets linked to the September breach over six days, according to blockchain intelligence firm Arkham. Most of the funds entered CoinJoin transactions, which make it harder to trace Bitcoin movements. Arkham's November 12 update showed that 847.26 BTC, worth USD 63.43 million, entered these transactions between November 6 and November 11.
The transfers followed a breach that Bitget initially valued at USD 351.6 million. The exchange later raised that figure to USD 387.5 million after accounting for additional assets. Meanwhile, Arkham's latest findings show continued movement from wallets associated with the incident.
According to Arkham, the hacker moved an average of 175.39 BTC daily, worth approximately USD 13.10 million. Activity began on November 6, when 137.71 BTC valued at USD 10.47 million left the wallets.
The following day, transfers rose to 156.04 BTC, worth USD 11.86 million. However, activity slowed sharply on November 8, when only 16.75 BTC, valued at USD 1.27 million, moved.
Transfers then increased over three consecutive days. Arkham recorded 206.31 BTC on November 9 and 238.79 BTC on November 10. By November 11, daily outflows reached 296.74 BTC, worth USD 21.83 million.
The November 11 figure exceeded twice the amount recorded on November 6. Arkham's reporting cutoff for that day came at 11:58 UTC, before midday.
Earlier activity showed a similar pattern of wallet transfers. Between October 21 and October 24, Arkham tracked USD 19.48 million leaving linked addresses. At that stage, most funds reached new wallets without any identified exchange or mixing destination.
Arkham traced approximately 80.5% of the latest Bitcoin outflows into CoinJoin transactions. The process combines Bitcoin from multiple participants, making individual transaction paths harder to identify.
Of the 847.26 BTC entering CoinJoin, approximately 579.80 BTC moved directly from labeled wallets. Those transfers carried an estimated value of USD 43.59 million.
The remaining 267.46 BTC, worth USD 19.84 million, passed through new addresses before entering CoinJoin. Arkham identified routes involving between one and six transfers.
The WabiSabi protocol documentation explains how CoinJoin combines participants' inputs into transactions without directly revealing which outputs belong to them. What happened to the Bitcoin that did not enter CoinJoin?
Arkham identified another 205.08 BTC, worth USD 15.18 million, outside CoinJoin transactions. Of that amount, 172.33 BTC remained unspent across 250 addresses.
Another 16.38 BTC continued moving through addresses, while 10 BTC reached Maya Protocol. Arkham also identified 4.37 BTC distributed across 433 smaller outputs.
Read More: Thailand to Block Bitget from December 5 Over Unlicensed Crypto Trading
Arkham's latest dashboard valued assets remaining in labeled wallets at USD 71.86 million. Bitcoin represented more than 99% of that total, while stablecoins and other cryptocurrencies accounted for the remainder.
The dashboard classified USD 339,320 as frozen and USD 71.52 million as liquid. It also listed 241,026 USDT, 134,456 USDC and 18.358 ETH, alongside smaller TRX and USDD balances.
These figures mark a reduction from October, when Arkham valued remaining labeled holdings at USD 242.54 million. At that time, the wallets contained approximately 2,960.01 BTC.
Meanwhile, Bitget continues to offer rewards through its recovery program. Eligible participants can receive 5% of funds they directly help freeze and another 5% of funds they recover.
The exchange determines eligibility and payments based on individual contributions. The program excludes actions conducted under court orders, law enforcement requests or other legal processes.
Bitget previously named Mandiant and SlowMist as investigation partners. In its September investigation update, the exchange also reported that it had identified and fixed the vulnerability behind the breach.
Arkham traced USD 78.61 million in Bitcoin transfers linked to the Bitget hacker, with approximately 80.5% entering CoinJoin transactions. The remaining labeled wallets held USD 71.86 million in assets. Bitget's recovery program continues to offer separate rewards for freezing and recovering eligible funds.