Bitget hacker moves $19.48 million in 52 transfers, Arkham says

The Bitget hacker has moved $19.48 million in 52 transfers, almost entirely in Bitcoin, as Arkham tracks fresh outflows from wallets linked to the exchange’s September breach.

Arkham put the transfers between 10:02 UTC on Oct. 21 and 02:48 UTC on Oct. 24, with Bitcoin accounting for $19.33 million and ETH making up the rest. Its thread said almost all the funds went to new addresses.

The blockchain intelligence firm framed its update as a question.

“Is the Bitget Hacker laundering the stolen funds?”

Arkham’s posts do not name an exchange, mixer, or over-the-counter desk receiving the latest transfers. The update documents money leaving labeled wallets, without establishing whether those assets were sold, cashed out, or recovered.

Bitget hacker movements total $78 million since Oct. 15

Across a longer reporting window, Arkham said the attacker had sent $78.01 million to new addresses since Oct. 15. Its daily breakdown showed $23.31 million moving on Oct. 15, followed by $8.68 million on Oct. 16 and $1.15 million on Oct. 17.

Another $10.51 million moved on Oct. 18. After no recorded movement on Oct. 19, the firm listed $15.13 million on Oct. 20, $11.74 million on Oct. 21, $184,160 on Oct. 22, and $7.3 million on Oct. 23.

The dates in Arkham’s opening post cover 64 hours and 46 minutes. A later post in the same thread described the $19.48 million as moving over “the past 48 hours,” leaving a mismatch between its shorthand description and the precise timestamps.

Using the firm’s rounded asset figures, Bitcoin represented approximately 99.2% of that $19.48 million. The implied ETH component was $150,000, although Arkham did not provide an exact token quantity in the opening post.

Arkham’s remaining balance uses a $350 million baseline

In its thread, Arkham valued the hacker’s remaining labeled holdings at $242.54 million, including 2,960.01 BTC worth $241.99 million. It listed smaller balances on Ethereum, Hypercore, Solana and Tron.

The firm described that balance as 69% of a $350 million theft. Bitget’s own accounting puts the incident at approximately $387.5 million, after revising its initial $351.6 million estimate.

In its Sep. 25 recovery notice, the exchange said the revision included Zcash and TRON assets omitted from the first calculation. Bitget attributed the change to a more complete classification of the original transfers and said it did not represent further theft.

Against Bitget’s $387.5 million estimate, Arkham’s $242.54 million snapshot equals approximately 62.6%. Neither percentage establishes how much has been recovered, because the figures compare remaining labeled holdings with dollar estimates from the original incident.

Arkham data shows $239.34 million, including approximately 2,958 BTC valued at $238.79 million.

Earlier tracing identified CoinJoin and cross-chain routes

Fund movements linked to the attack began before October. As crypto.news previously reported, AMLBot traced roughly four BTC into CoinJoin in September, describing the activity as an apparent effort to obscure stolen funds.

AMLBot’s account followed assets from TRON into USDT, across to Ethereum through USDT0, and through ETH swaps and THORChain before they reached Bitcoin. The firm said approximately 4.59 BTC emerged from that route before the Bitcoin was split into smaller amounts.

Independent tracing by Bitquery documented other September conversions through THORChain and Chainflip. Its investigation matched 66 swaps to 126.71 BTC in payments by 14:38 UTC on Sep. 25, while identifying two swaps still waiting at that snapshot.

Those historical routes do not establish the destinations of Arkham’s latest transfers. The October screenshots contain transaction graphs but no readable transaction-level evidence connecting the new outflows to the same services.

Bitget says withdrawals have resumed while recovery continues

Bitget’s incident explainer, updated Oct. 20, says its phased withdrawal restoration finished on Oct. 2 after BTC, ETH and USDT services reopened in September. The company says customer account balances remain unaffected and that it has identified no further unauthorized transfers following containment.

In the same explainer, Bitget attributed the breach to a vulnerability in a third-party security product. The company said the attacker obtained high-level internal credentials and submitted fraudulent withdrawal commands that bypassed existing risk controls. Bitget said the affected systems were isolated and the vulnerability was fixed.

Earlier coverage of the withdrawal reopening and reserves recorded CEO Gracy Chen’s statement that the Protection Fund had returned above $300 million on Sep. 30. Bitget has said the fund would absorb the financial loss from the breach.

The Sep. 25 notice names Mandiant and SlowMist as investigation partners and publishes receiving addresses across Ethereum-compatible networks, XRP Ledger, Zcash and TRON. Its recovery section says some assets had already been frozen through coordination with industry partners, but does not give an aggregate frozen amount in that notice.

The exchange’s recovery program offers separate 5% rewards for eligible voluntary actions that directly freeze or recover affected assets. Bitget excludes actions carried out under court orders, law-enforcement requests, or other legal processes, and retains discretion over eligibility and payment.