Bitget Hacker Moves $78.6M in Bitcoin, Most Routed Through CoinJoin
Blockchain analytics firm Arkham reports the Bitget exploiter has moved $78.61 million in Bitcoin out of labeled wallets over six days, with most entering CoinJoin transactions. The wallets still hold about $71.4 million in Bitcoin, and recovery efforts are ongoing.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Outflows Over Six Days
The wallets linked to the Bitget exploit have sent 1,052.34 BTC, worth $78.61 million, out of labeled addresses since November 6, according to Arkham. Of that total, 847.26 BTC ($63.43 million) entered CoinJoin transactions, and 959.29 BTC ($71.44 million) remained in the labeled wallets, per the firm's update posted in a thread dated November 12.
The two reports covering the same data differ in how they frame the CoinJoin share and the remaining balance. The Defiant's summary centers on the $63 million routed through mixing, while Crypto.news puts the total outflow at $78.6 million and calculates CoinJoin's share at roughly 80.5%. Both figures are consistent with Arkham's underlying numbers: $63.43 million divided by $78.61 million gives that 80.5% ratio.
Daily Pattern and Tracing Detail
Daily outflows rose through the period. Arkham logged 137.71 BTC on November 6, 156.04 BTC on November 7, and then slowed to 16.75 BTC on November 8. Activity picked up again with 206.31 BTC on November 9, 238.79 BTC on November 10, and 296.74 BTC on November 11, the largest single day, which was worth $21.83 million. Arkham noted the final day's reporting cutoff fell before midday UTC, so its total may be incomplete.
Of the CoinJoin volume, Arkham traced 579.80 BTC ($43.59 million) directly from labeled wallets. Another 267.46 BTC ($19.84 million) passed through fresh addresses over one to six hops before reaching the mixing transactions. Arkham separately classified 205.08 BTC ($15.18 million) as moved but not mixed, of which 172.33 BTC remained unspent across 250 addresses.
Context From Earlier Tracing
Arkham's October 24 snapshot had recorded $19.48 million in transfers over three days, mostly to new addresses with no exchange or mixer identified, and valued remaining labeled holdings at $242.54 million, including 2,960.01 BTC. The current balance is far smaller, which indicates the bulk of those holdings have since been moved.
The same pattern appeared at a smaller scale in September, when AMLBot linked about four BTC to CoinJoin after tracing funds from TRON through USDT0, Ethereum and THORChain. The firm described that route as an apparent effort to obscure stolen assets.
Remaining Holdings and Recovery Efforts
Arkham's portfolio dashboard shows $71.86 million in labeled wallets, with Bitcoin making up more than 99% of that value. The dashboard classifies about $339,320 as frozen and $71.52 million as liquid. Smaller balances include 241,026 USDT, 134,456 USDC and 18.358 ETH.
The activity follows the September 24 breach. Bitget first valued the transferred assets at $351.6 million and later revised the figure to $387.5 million, saying the increase reflected Zcash and TRON assets left out of the original calculation rather than new withdrawals. Bitget also runs a recovery bounty program offering eligible participants a share of recovered funds. Arkham's figures are its own tracing estimates and have not been confirmed by Bitget in the sources reviewed.
Why It Matters
For Traders
Continued Bitcoin outflows from the exploiter's wallets could add sell pressure if coins are converted, though the amounts are small relative to daily market volume.
For Investors
The exploit highlights ongoing custody and security risk at centralized exchanges, which may factor into how the sector is valued over longer horizons.
For Builders
The use of WabiSabi-style CoinJoin to obscure funds underscores why exchange and protocol teams should monitor mixing-protocol inflows and build detection into compliance tooling.
This article is for information only and is not financial advice. Read the full disclaimer.
