Bitget Hacker Moves $19.48M: Arkham Traces Bitcoin Flows

Bitget-linked wallets shift $19.48 million in fresh transfers

Blockchain intelligence firm Arkham has reported that wallets tied to the September Bitget breach moved $19.48 million across 52 transactions over a recent multi-day window, with nearly all value transacted in Bitcoin. The on-chain tracing update raises renewed concerns about potential laundering activity and the evolving tactics used to obscure stolen crypto.

Arkham’s timeline and asset breakdown

Arkham places the transfers between 10:02 UTC on October 21 and 02:48 UTC on October 24. Of the $19.48 million that changed hands in 52 transfers, Bitcoin represented about $19.33 million while the remainder was denominated in Ethereum. Arkham’s thread noted that most of the funds were sent to newly created addresses, fueling speculation about layering and movement into additional privacy or conversion services.

Is the attacker laundering the funds?

In its public post, Arkham framed the situation with a direct question: “Is the Bitget Hacker laundering the stolen funds?” The firm did not, however, identify explicit on-chain destinations such as a centralized exchange, a known mixer, or an over-the-counter (OTC) desk that received the latest outflows. The update documents outbound flows from labeled wallets but stops short of establishing whether those assets were sold, cashed out, frozen, or later recovered.

Wider outflow pattern: $78.01 million since Oct. 15

Looking at a broader window, Arkham reports the attacker moved approximately $78.01 million to new addresses between October 15 and October 23. Arkham’s daily breakdown for that period included notable outflows: $23.31 million on October 15; $8.68 million on October 16; $1.15 million on October 17; $10.51 million on October 18; none recorded on October 19; $15.13 million on October 20; $11.74 million on October 21; $184,160 on October 22; and $7.3 million on October 23.

The firm’s shorthand referred to the $19.48 million movement as occurring over the “past 48 hours,” though timestamps in Arkham’s posts extend across approximately 64 hours and 46 minutes, creating a minor mismatch between the narrative and exact log times.

Remaining labeled holdings and valuation differences

Arkham’s snapshot values the attacker’s remaining labeled holdings at $242.54 million, including 2,960.01 BTC valued at $241.99 million at the time of reporting. The firm also lists smaller token balances across Ethereum, Hypercore, Solana and Tron. Arkham described that remaining sum as 69% of a $350 million baseline tied to its internal valuation of the theft.

Bitget’s own revised accounting estimates the breach at roughly $387.5 million after adjustments to the original $351.6 million figure. Bitget said its September 25 recovery notice expanded the tally to include previously omitted Zcash and TRON assets, clarifying the attack’s full scope rather than indicating additional losses.

Measured against Bitget’s $387.5 million estimate, Arkham’s remaining labeled balance of $242.54 million corresponds to about 62.6% of that total. Note that neither percentage directly measures recovered assets—these figures compare remaining on-chain holdings flagged by Arkham with dollar estimates from earlier incident reports. Arkham’s own dataset also shows an alternate snapshot of $239.34 million, which included roughly 2,958 BTC (valued at $238.79 million), reflecting slight valuation and timing differences in open-source tracing.

Historical tracing: CoinJoin, cross-chain swaps and THORChain routes

Tracing linked to the attack goes back to September. Independent researchers recorded attempts to obscure the trail through CoinJoin and cross-chain swap services. AMLBot traced about four BTC into CoinJoin in September, interpreting the movement as an effort to obfuscate stolen funds. Their workflow tracked assets hop-by-hop: transfers from TRON into USDT, across to Ethereum via wrapped or bridged USDT, through ETH swaps and THORChain bridges, then eventually into Bitcoin. About 4.59 BTC exited that chain of swaps before being split into smaller outputs.

Bitquery’s analysis similarly documented conversions through THORChain and Chainflip in late September. Bitquery matched 66 swaps totaling roughly 126.71 BTC by 14:38 UTC on September 25 and flagged two swaps that were still pending at that snapshot. These historical mixing and bridge pathways demonstrate common laundering techniques—cross-chain swaps, decentralized exchange routing, and CoinJoin-style aggregation—though Arkham’s October screenshots did not include transaction-level evidence directly tying the new outflows to those same services.

Bitget’s response: withdrawals, containment and recovery

Bitget updated its incident explainer on October 20, saying a phased restoration of withdrawals had finished on October 2 after BTC, ETH and USDT services reopened in September. The exchange maintains that customer account balances were not impacted and that no further unauthorized transfers were identified after containment. Bitget attributes the breach to a vulnerability in a third-party security product; the attacker reportedly acquired high-level internal credentials and executed fraudulent withdrawal commands that bypassed the company’s risk controls. Affected systems were isolated and remediated, Bitget says.

CEO Gracy Chen previously announced that Bitget’s Protection Fund had recovered to above $300 million as of September 30, and the exchange has stated the fund will absorb financial losses stemming from the incident. Bitget named Mandiant and SlowMist as investigation partners in its September 25 notice and published receiving addresses across multiple chains, including Ethereum-compatible networks, the XRP Ledger, Zcash and TRON. The exchange also said some assets had been frozen in coordination with industry partners, while not publishing an aggregate frozen total in that notice.

Recovery incentives and limits

Bitget’s recovery program offers a 5% reward for eligible voluntary actions that directly freeze or recover affected assets, excluding actions ordered by courts, law enforcement, or other legal processes. The exchange retains discretion over eligibility and reward payments, a standard approach designed to incentivize industry cooperation while avoiding interference with formal investigations.

What this means for on-chain tracing and the crypto ecosystem

The recent $19.48 million movement highlights how attackers repeatedly move stolen crypto through complex, multi-chain routes to complicate tracing and potential recovery. While Arkham’s labeling provides transparency about on-chain exits, the firm’s update underscores the difficulty of conclusively proving cash-out, laundering, or final destinations without additional transactional evidence or coordinated takedowns.

For exchanges, custodians and institutional crypto investors, the incident is a reminder to strengthen third-party security controls, enhance on-chain monitoring, and maintain active collaboration with blockchain analytics firms. For researchers and law enforcement, continued open-source tracing and cross-industry cooperation remain critical to following funds and pursuing recoveries when possible.

Arkham’s question remains open: is this active laundering or a sequence of repositioning steps that will reveal their end game? As investigators and counterparties analyze the new outflows, the case will be an important test of modern blockchain forensics and the broader resilience of crypto theft remediation efforts.