Arkham: Bitget Hacker Moved $19.48M in 52 Transfers

Wallets linked to the September Bitget breach pushed $19.48 million out across 52 transfers between Oct. 21 and Oct. 24, according to blockchain intelligence firm Arkham, with $19.33 million of that total in Bitcoin and the remainder in Ether. Coincentral reported that Arkham timed the activity from 10:02 UTC on Oct. 21 to 02:48 UTC on Oct. 24 and said nearly all of the funds landed in fresh addresses.

The tracker framed its update as a question about whether the attacker is laundering the stolen assets, but it stopped short of naming an exchange, mixing service or over-the-counter desk on the receiving side. Coincentral noted the destinations remain unidentified, so laundering is not established.

Key facts

• Arkham recorded $19.48 million in 52 transfers from Oct. 21 to Oct. 24, including $19.33 million in Bitcoin.
• Hacker-linked wallets sent $78.01 million to new addresses between Oct. 15 and Oct. 23, led by $23.31 million on Oct. 15.
• Arkham valued the remaining labeled holdings at $242.54 million, including 2,960.01 BTC worth $241.99 million.
• Arkham cited a $350 million theft baseline, while Bitget puts the incident at about $387.5 million.
• Security firm Hacken recorded $1.18 billion in third-quarter crypto hack losses across 107 incidents, up 55% from the second quarter.

A day-by-day trail of outflows

The October window is only part of a longer pattern. Arkham’s daily breakdown shows $8.68 million departing on Oct. 16 and $1.15 million on Oct. 17, followed by $10.51 million on Oct. 18 and no recorded movement on Oct. 19. Activity resumed with $15.13 million on Oct. 20, $11.74 million on Oct. 21, $184,160 on Oct. 22 and $7.3 million on Oct. 23.

Crypto.news pointed out a discrepancy inside Arkham’s own thread: the timestamps in its opening post span 64 hours and 46 minutes, while a later post described the same $19.48 million as moving over “the past 48 hours.” Using Arkham’s rounded asset figures, Bitcoin accounted for roughly 99.2% of the total, implying an Ether component of about $150,000, though Arkham did not give an exact token quantity.

Earlier tracing, covered by Crypto.news and Finbold, found CoinJoin and cross-chain activity in September. AMLBot followed roughly four BTC into CoinJoin and said about 4.59 BTC emerged from a route running through TRON, USDT, Ethereum and THORChain. Bitquery matched 66 swaps to 126.71 BTC in payments by Sep. 25, with two swaps still waiting at that snapshot. None of that establishes where the newest transfers went.

How the totals compare

Arkham described the $242.54 million still sitting in labeled wallets as 69% of a $350 million theft. Bitget’s own accounting is larger: Crypto.news reported the exchange revised its estimate to approximately $387.5 million from an initial $351.6 million, a change its Sep. 25 notice attributed to Zcash and TRON assets omitted from the first calculation rather than to further theft. Measured against the revised figure, Arkham’s snapshot comes to about 62.6%. Finbold cited the breach at $387.5 million to $388 million.

Bitget said its phased withdrawal restoration was completed on Oct. 2, that customer balances were not affected, and that it has found no further unauthorized transfers since containment. The exchange blamed a vulnerability in a third-party security product, saying the attacker obtained high-level internal credentials and sent fraudulent withdrawal commands. CEO Gracy Chen said the Protection Fund returned above $300 million on Sep. 30, and the fund is slated to absorb the loss. A recovery program offers 5% rewards for eligible actions that freeze or recover assets, excluding actions taken under court orders or law-enforcement requests. Crypto.news reported that Mandiant and SlowMist were named as investigation partners.

Why it matters

Splitting stolen coins across unused addresses complicates recovery and can precede a push through bridges, mixers or cash-out channels, which is why trackers publish the flows even when recipients are unknown. The breach sits inside a heavier quarter for attacks: Hacken counted $1.18 billion in third-quarter losses across 107 incidents, against $763.9 million across 67 in the second quarter. For Bitget users, the operational picture is settled, with withdrawals restored and balances untouched while tracing continues.

What to watch

The next signal is whether Arkham or another tracker identifies where the fresh addresses forward funds, and whether Bitget’s recovery program reports new freezes. Bitcoin traded near $80,666 at the time Coincentral reported; this is not financial advice, and crypto markets are volatile and uncertain.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: CoinCentral, Crypto.news, Finbold