Bitget Hacker Moves $78.61M in Bitcoin (BTC) Through CoinJoin, Arkham Data Shows
Key Takeaways
- •On-chain data from Arkham Intelligence shows that the majority of Bitcoin linked to the Bitget hacker is now held in CoinJoin privacy transactions rather than on exchanges.
- •A total of 1,052.34 BTC, valued at $78.61 million, moved out of wallets labeled as belonging to the hacker over a six-day period.
- •Of those funds, $63.43 million subsequently entered CoinJoin transactions, which mix inputs and outputs from multiple users to obscure the link between senders and recipients.
- •Coins moved into CoinJoin remain visible on Bitcoin's public ledger, but their ownership trail becomes significantly harder for outside observers to trace.
- •The shift into privacy pools complicates asset recovery because exchange compliance teams can flag or freeze deposits tied to labeled hacker wallets, and as of the report none of the funds had been observed sitting on any exchange.
Most of the Bitcoin (BTC) attributed to the Bitget hacker is now held within CoinJoin transactions rather than sitting on any cryptocurrency exchange, according to on-chain data from Arkham Intelligence cited in a November 11, 2026 report by COINOTAG.
Arkham's tracking shows that $63.43 million of the hacker's coins entered CoinJoin privacy transactions after 1,052.34 BTC, worth $78.61 million, moved out of wallets labeled as belonging to the hacker across six days.
CoinJoin is a privacy-enhancing technique on the Bitcoin network that combines transactions from multiple users into a single, larger transaction. By mixing inputs and outputs from many participants, it breaks the direct link between individual senders and recipients, making it considerably harder for outside observers to trace which funds belong to whom. Because it pools funds from many users, a single CoinJoin transaction can contain coins from ordinary privacy-conscious users alongside those of any threat actor. Privacy-focused Bitcoin wallets have long offered CoinJoin for this purpose. The technique obscures ownership rather than removing funds from the blockchain, so the coins remain visible on Bitcoin's public ledger even as their trail becomes harder to follow.
Arkham Intelligence is a blockchain analytics platform known for labeling wallet addresses linked to exchanges, institutions, and threat actors, including hackers. Its labeled addresses are widely used by analysts and trading platforms to monitor the movement of stolen funds across the blockchain.
The shift into CoinJoin carries practical significance for asset recovery efforts. Privacy pools fragment and obscure the transaction trail, complicating attempts by investigators and exchanges to attribute specific outputs to a thief. Compliance teams at trading platforms routinely monitor deposits associated with labeled hacker wallets and can flag or freeze suspicious inflows, which is one reason analysts closely watch whether stolen coins reach exchanges. Bitget, the exchange whose name is attached to the labeled wallets, is one of the major global cryptocurrency trading venues.
As of the report, the funds in question had not been observed sitting on any exchange.
This content was first published on COINOTAG.
