Bitget Hack Update: Hacker Moves $78.6M in BTC, Most to CoinJoin
Arkham Flags 1,052 BTC Leaving Hacker Wallets in Six Days
Latest crypto news from Arkham brings a fresh Bitget hack update. The blockchain analytics firm says 1,052.34 BTC, worth about $78.61 million, left wallets it attributes to the hacker. The outflows covered six days, up to November 12, 2026.
Arkham shared the figures in an on-chain tracking post on November 11, 2026, with further coverage appearing on November 12.
How Much Bitcoin Entered CoinJoin Transactions
Of the total, 847.26 BTC ($63.43 million) entered CoinJoin transactions. That is about 80.5% of the outflow. Arkham's Bitget hack update puts the number of CoinJoin transactions at 66.
Movement | Amount (BTC) | Value |
Left-labeled wallets | 1,052.34 | $78.61M |
Entered CoinJoin | 847.26 | $63.43M |
Other destinations* | 205.08 | $15.18M |
The rest went to other destinations. Some outputs are unspent, and small amounts reached protocols such as Maya and THORChain.
CoinJoin combines inputs from several users in one Bitcoin transaction, which makes specific coins harder to follow. Arkham's live entity tracker shows the labelled addresses and their transfers.
Bitget Hack Update: 959 Bitcoin Still Sits in Labelled Wallets
The tracked addresses still hold 959.29 BTC, valued at $71.44 million. Bitcoin makes up more than 99% of the remaining holdings. Smaller balances include USDT, USDC, and about 18 ETH.
Adding the two figures suggests the wallets held about 2,011 BTC before the outflows. On that basis, roughly 52% has moved in six days. This is a calculation, and it assumes no new deposits.
Dollar values will shift with the Bitcoin price and any further transfers.
What Happened in the September 24 Bitget Breach
On September 24, 2026, unauthorized transfers hit the hot and warm wallets of a major crypto exchange. The attack ran from about 18:31 to 21:23 UTC across multiple chains.
The exchange's official incident page puts the verified loss at about $388 million across 12 wallet addresses. Cold wallets and private keys were not compromised.
Its first security notice says systems flagged anomalies around 19:05 UTC, and withdrawals were paused. The investigation later found a zero-day flaw in a third-party security product. Attackers used it to gain high-privilege credentials and insert forged withdrawal instructions. Mandiant and SlowMist reported the same cause.
User balances stayed accurate, and the exchange's User Protection Fund covered the platform loss.
Why Tracing the Stolen Bitcoin Gets Harder After Mixing
CoinJoin does not erase a trail, but it makes specific coins harder to follow. Arkham's labels also rely on clustering methods, so attribution can be refined over time.
Recovery remains uncertain. The exchange offers a bounty of up to 5% of frozen or recovered funds, and only a small share was frozen in the early weeks. It says recovery work, cooperation with authorities, and security upgrades continue.
This Bitget hack update shows the stolen funds still moving nearly seven weeks after the breach. Readers can follow further cryptocurrency news as new transfers appear.
Disclaimer: This article is for educational and informational purposes only and should not be considered financial or investment advice. Always conduct your own research before making investment decisions.
