Blockchain intelligence firm Arkham tracked $78.6 million in Bitcoin moved from Bitget breach wallets, with roughly 80% funneled through CoinJoin mixers.
Arkham Intelligence reported that the hacker behind the September 24 Bitget breach moved more than $78 million in Bitcoin from wallets linked to the attack over a six‑day period ending on Nov 11. The bulk of the outflows—about four‑fifths of the total—were sent through CoinJoin mixing services, a technique designed to obscure the link between inputs and outputs.
Between Nov 6 and Nov 11 the hacker‑controlled addresses sent 1,052.34 BTC, valued at $78.61 million at the time of reporting. Arkham’s daily breakdown shows an initial outflow of 137.71 BTC ($10.47 M) on Nov 6, rising to 156.04 BTC ($11.86 M) on Nov 7, dropping to 16.75 BTC ($1.27 M) on Nov 8, then climbing to 206.31 BTC, 238.79 BTC and a peak of 296.74 BTC ($21.83 M) on Nov 11. The average daily outflow across the period was 175.39 BTC, or roughly $13.1 million.
Arkham traced 847.26 BTC into 66 CoinJoin transactions, representing about 80.5% of the total Bitcoin moved. Of this amount, 579.80 BTC ($43.59 M) went directly from the labeled wallets, while another 267.46 BTC ($19.84 M) passed through fresh addresses before entering the mixers. The remaining 205.08 BTC ($15.18 M) was classified as unmixed, with 172.33 BTC still sitting idle across 250 addresses.
At the latest snapshot, 959.29 BTC ($71.44 M) remained in the tracked wallets, alongside stablecoins and a small amount of ETH. Bitget’s recovery bounty program offers a 5% reward for participants who help freeze or recover funds, though actions taken under court orders or law‑enforcement directives are excluded. The exchange continues to work with Mandiant and SlowMist on the investigation and has patched the vulnerability that enabled the original breach.
Follow Arkham’s ongoing monitoring for any further CoinJoin activity that could signal the next stage of fund distribution, and watch for updates from Bitget on the effectiveness of its bounty program and any recovered assets.
CoinJoin combines multiple users’ inputs into a single transaction, making it difficult to link specific inputs to outputs and thereby enhancing privacy.
The outflows began on Nov 6, 2026, and continued through Nov 11, 2026.
Arkham reports that 172.33 BTC ($12.72 M) is still idle across 250 addresses.
Discussion 0