Arkham Intelligence reported that the hacker behind the September 24 Bitget breach moved more than $78 million in Bitcoin from wallets linked to the attack over a six‑day period ending on Nov 11. The bulk of the outflows—about four‑fifths of the total—were sent through CoinJoin mixing services, a technique designed to obscure the link between inputs and outputs.

BTC / USD
Source: CoinGecko. Prices are indicative.

Scale and timing of the Bitcoin outflows

Between Nov 6 and Nov 11 the hacker‑controlled addresses sent 1,052.34 BTC, valued at $78.61 million at the time of reporting. Arkham’s daily breakdown shows an initial outflow of 137.71 BTC ($10.47 M) on Nov 6, rising to 156.04 BTC ($11.86 M) on Nov 7, dropping to 16.75 BTC ($1.27 M) on Nov 8, then climbing to 206.31 BTC, 238.79 BTC and a peak of 296.74 BTC ($21.83 M) on Nov 11. The average daily outflow across the period was 175.39 BTC, or roughly $13.1 million.

CoinJoin usage dominates the transfers

Arkham traced 847.26 BTC into 66 CoinJoin transactions, representing about 80.5% of the total Bitcoin moved. Of this amount, 579.80 BTC ($43.59 M) went directly from the labeled wallets, while another 267.46 BTC ($19.84 M) passed through fresh addresses before entering the mixers. The remaining 205.08 BTC ($15.18 M) was classified as unmixed, with 172.33 BTC still sitting idle across 250 addresses.

Remaining assets and Bitget’s response

At the latest snapshot, 959.29 BTC ($71.44 M) remained in the tracked wallets, alongside stablecoins and a small amount of ETH. Bitget’s recovery bounty program offers a 5% reward for participants who help freeze or recover funds, though actions taken under court orders or law‑enforcement directives are excluded. The exchange continues to work with Mandiant and SlowMist on the investigation and has patched the vulnerability that enabled the original breach.

What to watch next

Follow Arkham’s ongoing monitoring for any further CoinJoin activity that could signal the next stage of fund distribution, and watch for updates from Bitget on the effectiveness of its bounty program and any recovered assets.

FAQ

What is CoinJoin and why is it used?

CoinJoin combines multiple users’ inputs into a single transaction, making it difficult to link specific inputs to outputs and thereby enhancing privacy.

When did the Bitget hacker start moving the stolen Bitcoin?