Fund movements linked to the Bitget hacker reached $19.48 million across 52 transfers between October 21 and October 24, 2026, according to Arkham. Almost all of that value moved in Bitcoin, while the blockchain intelligence firm valued the attacker’s remaining labeled holdings at $242.54 million.
Key takeaways
- Bitcoin accounted for $19.33 million of the latest outflows.
- Arkham tracked $78.01 million sent to new addresses from October 15 through October 23.
- Bitget’s revised loss estimate stands at approximately $387.5 million.
- Bitget completed its phased withdrawal reopening on October 2.
Bitget hacker’s fund movements reach $78.01 million since October 15
Arkham recorded the latest transfers between 10:02 UTC on October 21 and 02:48 UTC on October 24. Bitcoin contributed $19.33 million, with ETH accounting for the remainder, and almost all the funds went to new addresses.
The precise timestamps span 64 hours and 46 minutes. They provide a more specific reporting window than a later post’s description of the transfers as occurring over “the past 48 hours.”
For October 15 through October 23, Arkham put transfers to new addresses at $78.01 million. Its daily figures included $23.31 million on October 15, $8.68 million on October 16, $1.15 million on October 17 and $10.51 million on October 18.
Arkham recorded no movement on October 19, followed by $15.13 million on October 20, $11.74 million on October 21, $184,160 on October 22 and $7.3 million on October 23.
Remaining holdings and breach estimates use different baselines
According to Arkham’s snapshot, the remaining labeled assets carried a total valuation of $242.54 million, with 2,960.01 BTC worth $241.99 million accounting for part of that figure. Smaller balances appeared on Ethereum, Hypercore, Solana and Tron.
The firm described those holdings as 69% of its $350 million theft estimate. Bitget uses a different baseline: approximately $387.5 million, revised from its initial $351.6 million calculation.
In its September 25 recovery notice, Bitget attributed the revision to the inclusion of Zcash and TRON assets omitted from the first calculation. The exchange said the adjustment reflected a fuller classification of the original transfers, rather than additional theft.
Against Bitget’s revised estimate, Arkham’s holdings snapshot represents approximately 62.6%. These comparisons measure remaining labeled assets against estimates of the original loss; they are not recovery totals.
September tracing followed CoinJoin and cross-chain routes
Earlier investigations traced stolen assets through CoinJoin and several cross-chain services. In September, AMLBot followed roughly four BTC into CoinJoin through Wasabi, describing the activity as an apparent attempt to obscure the funds.
AMLBot traced a route from TRON into USDT, then to Ethereum through USDT0, followed by ETH swaps and THORChain transfers into Bitcoin. Approximately 4.59 BTC emerged from that route before being divided into smaller amounts.
Bitquery separately documented September conversions through THORChain and Chainflip. By 14:38 UTC on September 25, its investigation had matched 66 swaps to 126.71 BTC in payments, with two swaps still pending at that snapshot.
Bitget restores withdrawals and pursues asset recovery
Bitget completed its phased withdrawal restoration on October 2, after reopening BTC, ETH and USDT services during September. Its incident explainer, updated October 20, says customer account balances remain unaffected and that it identified no further unauthorized transfers after containment.
The exchange identified a flaw within a third-party security product as the root cause of the breach. It said the attacker obtained high-level internal credentials and issued fraudulent withdrawal commands that bypassed risk controls. Bitget said it isolated the affected systems and fixed the vulnerability.
CEO Gracy Chen said the Protection Fund exceeded $300 million again on September 30. Bitget said the fund would absorb the breach’s financial loss.
The September 25 recovery notice named Mandiant and SlowMist as investigation partners and said coordination with industry partners had already frozen some assets. It also published receiving addresses across Ethereum-compatible networks, XRP Ledger, Zcash and TRON.
For qualifying voluntary actions that successfully freeze or recover the impacted assets, Bitget provides a distinct 5% reward. Actions under court orders, law-enforcement requests or other legal processes are excluded, and the exchange retains discretion over eligibility and payment.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.