On-chain intelligence platform Arkham has tracked $78.61 million in Bitcoin — 1,052.34 BTC — leaving wallets labeled as belonging to the Bitget hacker over a six-day period, with $63.43 million of that total routed through 66 CoinJoin transactions intended to obscure the flow of funds.

In a November 12 update posted on X, Arkham highlighted transfers carried out between November 6 and November 11, and disclosed that a significant Bitcoin balance still sits in the monitored wallets, currently valued at $71.44 million, or 959.29 BTC.

Bitget Hacker Moves More Than 1,000 BTC in Six Days

Arkham reported that 1,052.34 BTC, worth approximately $78.61 million, left wallets labeled as belonging to the Bitget hacker over the six-day window. The outflows began on November 6, when 137.71 BTC was transferred, and accelerated toward the end of the tracking period.

The heaviest single-day movement was recorded on November 11, when 296.74 BTC, valued at $21.83 million, moved out of the wallets at 11:58 UTC. That peak followed outflows of 206.31 BTC on November 9 and 238.79 BTC on November 10. On average, the wallets have sent 175.39 BTC — approximately $13.10 million — per day since November 6.

The activity is linked to the September security breach that Bitget allegedly suffered, an incident estimated at around $350 million. According to Arkham, a total of $192.6 million was withdrawn from three hot wallets and a cold wallet across six EVM chains — Ethereum-compatible networks — on September 24, with the funds directed to three different destinations, including one address.

$63.43M in Bitcoin Enters CoinJoin Transactions

CoinJoin activity formed the centerpiece of the recent movement. Arkham's tracing algorithm linked 847.26 BTC, valued at $63.43 million, to 66 CoinJoin transactions beginning at 09:27 UTC on November 6.

Of that amount, 579.80 BTC ($43.59 million) flowed directly into CoinJoin transactions from the labeled wallets. A further 267.46 BTC ($19.84 million) first transited through newly created addresses that had either one or six transactions connected to them.

CoinJoin aggregates multiple Bitcoin inputs into multiple outputs, complicating efforts to identify the source of a given output. While the technique makes transaction tracing more difficult, it does not necessarily mean the funds are untraceable. Exchanges and compliance teams routinely apply heightened screening to deposits carrying a CoinJoin history, which is why analysts watch mixing activity closely when hack proceeds move at this scale.

Where the Remaining Bitcoin Went

Outside of the CoinJoin activity, Arkham detected 205.08 BTC, valued at $15.18 million, that was transacted through other channels. This included 172.33 BTC spread across 250 addresses, which continued to move through 16.38 BTC in six hops. Arkham also observed 10 BTC sent to Maya Protocol and 2 BTC directed to THORChain and exchanges, while another 4.37 BTC surfaced in 433 small outputs. Maya Protocol and THORChain are decentralized cross-chain swap networks, meaning assets can move between blockchains without passing through a centralized custodian — a routing pattern analysts track when following funds across ecosystems.

Hacker-Linked Wallets Still Hold $71.44M in Bitcoin

Following the sustained transfers, the tracked wallets stood at $71.44 million, or roughly 959.29 BTC. According to Arkham, the labeled wallets held just over $71.86 million, with more than 99% of that balance in Bitcoin.

The latest figures show that substantial funds remain under observation even after more than $78 million in Bitcoin moved during the six-day period. Because the remaining balance sits in wallets already labeled by Arkham, any further movement can be followed through the same on-chain monitoring that surfaced this week's activity.

Source: Crypto Ninjas