The Bitget hacker has moved $78.61 million in Bitcoin out of labeled wallets over six days, with most of the funds entering CoinJoin transactions, according to Arkham.
Summary
- 1,052.34 BTC left hacker-labeled wallets between Nov. 6 and Nov. 11, according to Arkham.
- 847.26 BTC entered 66 CoinJoin transactions, accounting for approximately 80.5% of the Bitcoin moved.
- 959.29 BTC worth $71.44 million remained in the tracked wallets at the latest snapshot.
Arkham’s latest update, shared in a thread dated Nov. 12, traced $63.43 million into CoinJoin transactions beginning at 09:27 UTC on Nov. 6. Some Bitcoin went directly from labeled wallets, while other funds passed through fresh addresses before reaching the transactions.
The blockchain intelligence firm put average outflows since Nov. 6 at 175.39 BTC, or $13.10 million, a day. Its daily breakdown showed the largest movement on Nov. 11, when 296.74 BTC worth $21.83 million left the wallets by 11:58 UTC.
Bitget hacker transfers climb toward 300 BTC a day
Outflows began the six-day period at 137.71 BTC, valued at $10.47 million, on Nov. 6, followed by 156.04 BTC worth $11.86 million on Nov. 7. Activity slowed to 16.75 BTC, or $1.27 million, on Nov. 8.
Over the following three days, the amounts rose to 206.31 BTC on Nov. 9, 238.79 BTC on Nov. 10 and 296.74 BTC on Nov. 11, according to the thread. The final day’s total was more than twice the Nov. 6 amount, even though its reporting cutoff fell before midday UTC.
As crypto.news previously reported on Oct. 24, Arkham had tracked $19.48 million in transfers between Oct. 21 and Oct. 24. Almost all of those funds went to new addresses, with no exchange or mixer identified as the recipient in that update.
At that October snapshot, the firm valued remaining labeled holdings at $242.54 million, including 2,960.01 BTC. Its latest screenshots show a much smaller Bitcoin balance, alongside residual stablecoins and other assets.
CoinJoin accounts for four-fifths of the Bitcoin moved
Of the 847.26 BTC entering CoinJoin transactions, Arkham traced 579.80 BTC worth $43.59 million directly from labeled wallets. Another 267.46 BTC, valued at $19.84 million, traveled through fresh addresses over one to six hops.
Calculated from Arkham’s Bitcoin totals, CoinJoin accounted for approximately 80.5% of the six-day outflows. Direct transfers made up around 68.4% of the Bitcoin entering CoinJoin, with the remainder arriving through intermediate addresses.
The WabiSabi protocol documentation describes transactions that combine participants’ Bitcoin inputs and create outputs without exposing a direct input-to-output link to the coordinator or other participants.
Earlier tracing had identified the same type of activity on a smaller scale. In September, AMLBot linked roughly four BTC to CoinJoin after following funds from TRON through USDT0, Ethereum and THORChain. AMLBot described that route as an apparent effort to obscure stolen assets.
Unmixed funds include 172 BTC spread across 250 addresses
Arkham classified another 205.08 BTC, worth $15.18 million, as moved but not CoinJoined. Of that amount, 172.33 BTC worth $12.72 million remained unspent across 250 addresses, while 16.38 BTC valued at $1.22 million was still moving at six hops.
The breakdown listed 10 BTC worth $760,000 sent to Maya Protocol and 4.37 BTC worth $330,500 distributed across 433 small outputs.
Across the labeled wallets still holding assets, Bitcoin represented more than 99% of a $71.86 million portfolio, according to Arkham. The accompanying dashboard classified approximately $339,320 as frozen and $71.52 million as liquid.
The portfolio screenshot listed 241,026 USDT, 134,456 USDC, and 18.358 ETH, with smaller holdings in TRX and USDD beside the remaining Bitcoin.
Bitget’s recovery program offers separate freeze and recovery rewards
The movements follow the Sept. 24 breach, which Bitget initially valued at $351.6 million before revising the transferred-assets total to $387.5 million. Its investigation update said the revision included Zcash and TRON assets omitted from the first calculation and did not represent further unauthorized withdrawals.
Bitget’s recovery bounty program offers eligible participants 5% of funds they directly help freeze and a separate 5% of funds they directly help recover. The company determines eligibility, contributions, and payments; actions taken under court orders, law enforcement requests, or other legal processes are excluded.
The exchange named Mandiant and SlowMist as investigation partners in its September notice and said it had identified and fixed the underlying vulnerability.