Blockchain analytics firm Arkham says the hacker behind September's breach of crypto exchange Bitget moved $19.48 million across 52 transfers in a fresh wave of outflows, with almost the entire amount denominated in Bitcoin. The transfers took place between 10:02 UTC on Oct. 21 and 02:48 UTC on Oct. 24, marking new movements from wallets tied to the attack on the exchange. Bitcoin accounted for $19.33 million of the total, with Ether making up the remainder, and nearly all of the funds went to newly created addresses. The wave amounts to roughly a quarter of the total Arkham says has moved since Oct. 15.

Arkham, which labels and monitors wallet addresses on-chain and has tracked the hacker's wallets since the September exploit, raised the possibility that the funds are being laundered in a post on X:

Is the Bitget Hacker laundering the stolen funds?

The Bitget Hacker moved $19.48M out of its wallets in 52 transfers between 10:02 UTC on 21 October and 02:48 UTC this morning. $19.33M of that was BTC, the rest ETH.

Here are the flows: pic.twitter.com/3AQtyJ6NlJ

— Arkham (@arkham) October 24, 2026

https://x.com/arkham/status/2113870990715552069?ref_src=twsrc%5Etfw

The firm did not name any exchange, mixing service, or over-the-counter desk as a recipient of the latest transfers. The destinations remain unidentified, and laundering is not confirmed.

Hacker Has Moved $78 Million Since Oct. 15

The latest activity extends a broader pattern of outflows. According to Arkham, the attacker has sent $78.01 million to new addresses since Oct. 15. The single largest day was. 15, when $23.31 million moved, followed by $8.68 million on Oct. 16 and $1.15 million on Oct. 17. Daily outflows continued at $10.51 million on Oct. 18, with no movement recorded on Oct. 19. The pace resumed with $15.13 million on Oct. 20, $11.74 million on Oct. 21, $184,160 on Oct. 22, and $7.3 million on Oct. 23.

Remaining Holdings Valued at $242.54 Million

Arkham valued the hacker's remaining labeled holdings at $242.54 million, the bulk of it in Bitcoin: 2,960.01 BTC worth $241.99 million. Smaller balances sit on Ethereum, Hypercore, Solana, and Tron. Because most of the stolen funds remain in labeled wallets, any further movement can be observed on-chain, making the destinations of future transfers a key detail to watch as tracking continues.

The analytics firm characterized that balance as 69% of a $350 million theft. Bitget has put the incident's total at about $387.5 million; measured against that figure, Arkham's snapshot equals roughly 62.6%.

Earlier Tracing Found CoinJoin and Cross-Chain Routes

Previous tracing work documented earlier efforts to obscure the trail. In September, AMLBot traced about four Bitcoin into CoinJoin, a privacy technique that combines multiple users' payments into a single transaction, describing the activity as an apparent effort to hide stolen funds. The firm also said about 4.59 BTC moved out through a route spanning TRON, USDT, Ethereum, and THORChain, a cross-chain protocol for swapping assets between blockchains.

Bitquery separately documented other September conversions through THORChain and Chainflip, another cross-chain swapping protocol, matching 66 swaps to 126.71 BTC in payments by Sep. 25. Those routes do not show where the newest transfers went.

Bitget Says Customer Balances Unaffected, Withdrawals Restored

Bitget suspended withdrawals after the September incident and later restored them in phases, a process the exchange said concluded on Oct. 2. Customer balances remain unaffected, according to the company, which added that it has found no further unauthorized transfers since the incident was contained. The outflows Arkham is tracking come from the hacker's labeled wallets rather than from Bitget's systems.

Bitget blamed the breach on a flaw in a third-party security product. According to the exchange, the attacker obtained high-level internal credentials and sent forged withdrawal commands. The affected systems were isolated and the flaw was fixed, the company said.

Chief Executive Gracy Chen said the exchange's Protection Fund returned above $300 million on Sep. 30. Bitget has said the fund would cover the financial loss from the incident. Its recovery program offers 5% rewards for eligible actions that freeze or recover affected assets, a bounty-style structure designed to encourage the freezing and recovery of stolen funds.

Q3 Crypto Hack Losses Rose 55%

Separately, security firm Hacken reported that third-quarter cryptocurrency hack losses reached $1.18 billion across 107 incidents, a 55% increase from the second quarter, when it recorded $763.9 million across 67 incidents.

Bitcoin traded near $80,666 at the time of reporting.