Arkham Traces $63 Million in Bitget Hack Funds to CoinJoin

Wallets Arkham attributes to the Bitget hacker sent 847.26 $BTC, valued by the analytics firm at $63.43 million, into CoinJoin transactions beginning Nov. 6, according to an update published Nov. 11.

Arkham counted 66 transactions starting at 4:27 a.m. ET on Nov. 6. It said 579.80 $BTC went directly into CoinJoin, while 267.46 $BTC passed through fresh addresses in one to six intervening transfers.

CoinJoin combines multiple users’ bitcoin in a single transaction, making it harder to determine which outgoing coins belong to each participant. That complicates the recovery trail, while bitcoin itself lacks the centralized issuer that can freeze certain stablecoins.

In the same update, Arkham said 1,052.34 $BTC had left its labelled hacker wallets over six days. The CoinJoin amount represented about 80.5% of those outflows. Its snapshot put the remaining balance in those wallets at 959.29 $BTC, valued at $71.44 million—not a complete accounting of everything the attacker may still control.

The Sept. 24 breach cost the exchange approximately $388 million, according to Bitget’s latest accounting. The bitcoin mixing follows the conversion of stolen assets: security firm BlockSec reported in September that funds were being consolidated into $BTC, mainly through cross-chain swap protocol THORChain.

What the Bitcoin Records Show

Bitcoin transaction data corroborate an early mixing transaction at 4:27 a.m. ET on Nov. 6. Six inputs, totaling 18 $BTC, came from addresses on Bitget’s attacker-address list. Bitget’s tracker classifies that transaction as Wasabi CoinJoin. This confirms an example, rather than independently establishing Arkham’s entire tally.

Bitget’s separate tracking API lists 72 CoinJoin transactions with 866.23 $BTC in gross inputs from Nov. 6 through 6:58 a.m. ET on Nov. 11. Its documentation warns that gross deposits can count coins again when they enter another mixing round; its net measure also excludes funds subsequently traced out. Those measures are not interchangeable with Arkham’s tally.

Why Stablecoin Freezes Are Different

BlockSec’s September analysis found that Tether and Circle had frozen about $340,000 in stablecoins linked to the theft as of Sept. 29. Issuers can freeze token balances at specified addresses. Bitcoin has no equivalent central authority.

Mixing adds a separate obstacle: Wasabi’s documentation describes its goal as breaking the link between transaction inputs and outputs. Entering a CoinJoin transaction does not, by itself, establish that the funds have been cashed out or become unrecoverable.

Bitget says fund tracking and recovery remain ongoing. It offers eligible voluntary contributors bounties of 5% of funds successfully frozen or recovered.