TLDR
- Arkham says the Bitget hacker moved $19.48 million in 52 transfers between Oct. 21 and Oct. 24, almost all in Bitcoin.
- Wallets linked to the attack sent $78.01 million to new addresses between Oct. 15 and Oct. 23.
- Arkham valued the hacker’s remaining labeled holdings at $242.54 million, mostly in Bitcoin.
- Bitget says customer balances are unaffected, its Protection Fund covers the loss, and withdrawals reopened on Oct. 2.
- Hacken reported $1.18 billion in crypto hack losses in the third quarter, up 55% from the second quarter.
Blockchain firm Arkham says the hacker behind the Bitget breach moved $19.48 million in 52 transfers. Almost all of it was Bitcoin. The activity points to new outflows from wallets tied to the exchange’s September attack.
Is the Bitget Hacker laundering the stolen funds?
The Bitget Hacker moved $19.48M out of its wallets in 52 transfers between 10:02 UTC on 21 October and 02:48 UTC this morning. $19.33M of that was BTC, the rest ETH.
Here are the flows: pic.twitter.com/3AQtyJ6NlJ
— Arkham (@arkham) October 24, 2026
Arkham put the transfers between 10:02 UTC on Oct. 21 and 02:48 UTC on Oct. 24. Bitcoin made up $19.33 million of the total, and Ether made up the rest. Almost all of the funds went to new addresses.
Arkham asked in its thread whether the hacker is laundering the stolen funds. It did not name an exchange, mixer or over-the-counter desk that received the latest transfers. The destinations remain unidentified, so laundering is not confirmed.
Bitget hacker movements total $78 million since Oct. 15
Over a longer period, Arkham said the attacker sent $78.01 million to new addresses since Oct. 15. The largest day was Oct. 15, when $23.31 million moved. Another $8.68 million moved on Oct. 16 and $1.15 million on Oct. 17.
The daily totals continued at $10.51 million on Oct. 18 and none on Oct. 19. Then $15.13 million moved on Oct. 20, $11.74 million on Oct. 21, $184,160 on Oct. 22 and $7.3 million on Oct. 23.
Arkham valued the hacker’s remaining labeled holdings at $242.54 million. That includes 2,960.01 BTC worth $241.99 million. Smaller balances sit on Ethereum, Hypercore, Solana and Tron.
Arkham described that balance as 69% of a $350 million theft. Bitget puts the incident at about $387.5 million. Against that figure, Arkham’s snapshot equals about 62.6%.
Earlier tracing found CoinJoin and cross-chain routes
AMLBot traced about four Bitcoin into CoinJoin in September. It described the activity as an apparent effort to hide stolen funds. The firm said about 4.59 BTC came out of a route through TRON, USDT, Ethereum and THORChain.
Bitquery documented other September conversions through THORChain and Chainflip. It matched 66 swaps to 126.71 BTC in payments by Sep. 25. Those routes do not show where the newest transfers went.
Bitget says its phased withdrawal restoration finished on Oct. 2. The exchange says customer balances remain unaffected. It also says it has found no further unauthorized transfers since containment.
Bitget blamed the breach on a flaw in a third-party security product. The company said the attacker obtained high-level internal credentials and sent forged withdrawal commands. Bitget said the affected systems were isolated and the flaw was fixed.
CEO Gracy Chen said the Protection Fund returned above $300 million on Sep. 30. Bitget has said the fund would cover the financial loss. Its recovery program offers 5% rewards for eligible actions that freeze or recover affected assets.
Separately, security firm Hacken said third-quarter crypto hack losses reached $1.18 billion across 107 incidents. That is a 55% rise from the second quarter, when it recorded $763.9 million across 67 incidents. Bitcoin traded near $80,666 at the time of reporting.
