Bitget Hacker Moves $78.6M Bitcoin in Six Days

The Bitget hacker transferred 1,052.34 BTC (about $78.61 million) out of wallets flagged by blockchain intelligence firm Arkham over a six‑day window from Nov 6 to Nov 11. Most of the outflow – 847.26 BTC – entered 66 CoinJoin transactions, a mixing technique that obscures the link between inputs and outputs.

Outflows Overview

Arkham’s daily breakdown shows a steady rise in daily outflows, starting at 137.71 BTC ($10.47 M) on Nov 6 and peaking at 296.74 BTC ($21.83 M) on Nov 11. The average daily outflow across the period was 175.39 BTC, roughly $13.10 million.

CoinJoin Dominance

CoinJoin accounted for about 80.5 % of the total Bitcoin moved. Of the mixed coins, 579.80 BTC ($43.59 M) came directly from the labeled wallets, while 267.46 BTC ($19.84 M) passed through fresh addresses before entering the mixers. The WabiSabi protocol, a variant of CoinJoin, was noted for its ability to hide input‑to‑output links.

Remaining Holdings and Recovery Efforts

At the latest snapshot, 959.29 BTC ($71.44 M) remained in the tracked wallets. Bitcoin makes up more than 99 % of a $71.86 million portfolio that also holds USDT, USDC, ETH and minor assets. Bitget’s recovery bounty program offers a 5 % reward for participants who help freeze or recover funds, excluding actions taken under legal orders. The exchange has partnered with Mandiant and SlowMist to investigate the Sept 24 breach, which was initially valued at $351.6 M and later revised to $387.5 M after adding Zcash and TRON assets.

Key facts

• 1,052.34 BTC moved from labeled wallets (Nov 6‑11)
• 847.26 BTC (80.5 %) entered CoinJoin mixers
• Largest single‑day outflow: 296.74 BTC on Nov 11
• $71.44 M Bitcoin still held in tracked wallets
• Bitget offers 5 % bounty for freeze/recovery assistance