Bitget hacker moves $78.61M in Bitcoin, Arkham says

The blockchain intelligence firm’s update, shared in a thread dated Nov. 12, traced $63.43 million into CoinJoin transactions starting at 09:27 UTC on Nov. 6. Some Bitcoin moved directly from labeled wallets; other funds passed through fresh addresses first. Arkham put average daily outflows at 175.39 BTC, or $13.10 million.

Transfers rose over the six-day period after a brief slowdown. Outflows were 137.71 BTC on Nov. 6 and 156.04 BTC on Nov. 7, then fell to 16.75 BTC on Nov. 8. They climbed to 206.31 BTC on Nov. 9, 238.79 BTC on Nov. 10 and 296.74 BTC on Nov. 11. The last figure, worth $21.83 million, was recorded by 11:58 UTC.

Arkham traced 579.80 BTC of the CoinJoin total directly from labeled wallets. Another 267.46 BTC reached the transactions through fresh addresses over one to six hops. A further 205.08 BTC was moved without being classified as CoinJoined: 172.33 BTC remained unspent across 250 addresses, and 16.38 BTC was still moving at six hops. The breakdown also listed 10 BTC sent to Maya Protocol and 4.37 BTC distributed across 433 small outputs.

The remaining tracked portfolio was valued at $71.86 million, with Bitcoin making up more than 99%, according to Arkham. Its dashboard classified about $339,320 as frozen and $71.52 million as liquid, and listed 241,026 USDT, 134,456 USDC and 18.358 ETH, alongside smaller TRX and USDD holdings.

The transfers follow the Sept. 24 breach. Bitget first valued the incident at $351.6 million, then revised the transferred-assets total to $387.5 million, saying the update included Zcash and TRON assets omitted from its initial calculation and did not reflect further unauthorized withdrawals. The exchange said it identified and fixed the vulnerability and named Mandiant and SlowMist as investigation partners. Its recovery program offers eligible participants separate rewards of 5% for funds they directly help freeze and 5% for funds they directly help recover. Bitget determines eligibility, contributions and payments; actions taken under legal processes are excluded.