Arkham Tracks $19.48 Million in 52 Transfers From Bitget Hacker Wallets

A 52-Transfer Sweep in Bitcoin

Funds stolen from the Bitget crypto exchange in September are moving again in size. Wallets labeled as the breach's hacker sent $19.48 million across 52 transfers between 10:02 UTC on Oct. 21 and 02:48 UTC on Oct. 24, and almost the entire sum left as Bitcoin: $19.33 million, leaving an implied $150,000 in $ETH from the rounded figures, roughly 99.2 percent of the total. No exact token quantity was given for the $ETH remainder. The outflows came from labeled crypto wallets, addresses attributed to the breach, and almost everything landed at fresh crypto wallet addresses with no prior footprint. The starting map exists because Bitget's Sep. 25 recovery notice itself published receiving addresses across Ethereum-compatible networks, the XRP Ledger, Zcash and TRON.

Arkham Intelligence, the on-chain intelligence firm running the tracker, framed its update as a question: “Is the Bitget Hacker laundering the stolen funds?” Its on-chain tracking thread names no exchange, mixer or over-the-counter desk on the receiving side, and the posts document money leaving labeled wallets without establishing whether the assets were sold, cashed out, or moved toward recovery. The destination question is therefore open. Labeled wallets, in Arkham's system, are addresses the firm has matched to a named actor with high confidence, and the label travels with the coins wherever they move. One inconsistency in the thread deserves flagging because it changes the window: the opening post's timestamps span 64 hours and 46 minutes, while a later post describes the same $19.48 million as moved over “the past 48 hours.” The precise timestamps, running to 02:48 UTC on Oct. 24, remain the operative record.

The Ledger Since Oct. 15

Step back to Oct. 15 and the past week's $19.48 million reads as one slice of a longer ledger. Since that date, $78.01 million has left the hacker-linked wallets for new addresses. Arkham, which now gates its deepest enterprise on-chain analytics behind a $1,500-a-month plan, has published the daily breakdown, and it is uneven: $23.31 million on Oct. 15, $8.68 million on Oct. 16, $1.15 million on Oct. 17, then $10.51 million on Oct. 18. Nothing was recorded on Oct. 19. The pace resumed with $15.13 million on Oct. 20, $11.74 million on Oct. 21 and $7.3 million on Oct. 23, separated by only $184,160 on Oct. 22.

What remains is larger than what has moved. Arkham values the remaining labeled holdings at $242.54 million, including 2,960.01 $BTC worth $241.99 million, plus smaller balances on Ethereum, Hypercore, Solana and Tron. The firm frames that as 69 percent of a $350 million theft. Bitget's own accounting uses a different base. Its Sep. 25 notice revised the incident to approximately $387.5 million from an initial $351.6 million estimate, adding Zcash and TRON assets the exchange said had been omitted from the first calculation after a more complete classification of the original transfers, not stolen afterward. Against the higher figure, the same snapshot equals about 62.6 percent. Neither percentage establishes how much has actually been recovered, because both compare remaining labeled holdings with dollar estimates rather than confirmed returns.

The September record shows the attacker's routing habits formed early. AMLBot traced roughly four $BTC into CoinJoin, a mixing technique that combines transactions from many users to obscure origins, after following a path from TRON into $USDT, across to Ethereum through USDT0 and through THORChain, with about 4.59 $BTC emerging before the Bitcoin was split into smaller amounts. Independent tracing by Bitquery matched 66 swaps worth 126.71 $BTC by 14:38 UTC on Sep. 25, with two swaps still pending at that snapshot. Those routes do not extend to October: the latest outflows' destinations remain unidentified, and the material published with the thread carries no readable transaction-level evidence connecting the new movements to the same services.

What Bitget's Post-Mortem Confirms

Bitget's official incident explainer, updated Oct. 20, states the root cause plainly: a vulnerability in a third-party security product allowed the attacker to obtain high-level internal credentials and submit fraudulent withdrawal commands that bypassed existing risk controls. The company says it isolated the affected systems and fixed the flaw, that customer balances were unaffected, and that phased withdrawal restoration finished on Oct. 2 with no further unauthorized transfers identified after containment. CEO Gracy Chen said the Protection Fund, which is absorbing the loss, stood above $300 million on Sep. 30. The remediation is scoped to that one product integration; the open item is the $242.54 million still sitting in labeled wallets and where it lands next. For customers, the event renews the custody question, from cold storage to the crypto exchange versus crypto wallet tradeoff, and our guide to buying Bitcoin on Bitget covers the platform now that withdrawals are back.