Arkham trails 847 BTC of Bitget hack haul into CoinJoin mixers
Arkham says wallets tied to the Bitget hacker pushed 847.26 BTC, worth $63.43 million, into CoinJoin mixing starting Nov. 6. The exchange, still hunting a $388 million Sept. 24 breach, keeps promising recovery and bounties. Mixers make that hunt much harder.
- 3 sources report it: thedefiant.io, crypto.news, blockonomi.com.
- The source published it on Nov 11, 2026 at 7:55 PM.
- Readers flagged it and an editor is checking it.
Arkham's Nov. 11 update says wallets it attributes to the Bitget attacker sent 847.26 BTC into CoinJoin transactions beginning Nov. 6, a haul the analytics firm values at $63.43 million. The firm counted 66 transactions kicking off at 4:27 a.m. ET that day. Of the total, 579.80 BTC went straight into CoinJoin while 267.46 BTC hopped through fresh addresses across one to six intervening transfers.
CoinJoin bundles several users' bitcoin into one transaction, blurring which outgoing coins belong to whom. That gums up the paper trail. Arkham says 1,052.34 BTC left its labelled hacker wallets over six days, with the CoinJoin flow making up about 80.5% of those outflows. Its snapshot left 959.29 BTC, valued at $71.44 million, sitting in those wallets — not a full picture of what the attacker still controls.
The trail starts with a Sept. 24 breach that Bitget's latest accounting puts at roughly $388 million. BlockSec reported in September that the stolen assets were being consolidated into BTC, mostly through cross-chain swap protocol THORChain. Bitcoin transaction data backs up an early mixing move at that 4:27 a.m. ET timestamp: six inputs totaling 18 BTC from addresses on Bitget's attacker list, which the exchange's tracker labels Wasabi CoinJoin.
Bitget's own tracking API lists 72 CoinJoin transactions with 866.23 BTC in gross inputs from Nov. 6 through 6:58 a.m. ET on Nov. 11, though its documentation warns gross deposits can count coins again when they re-enter mixing. On the stablecoin side, BlockSec found Tether and Circle had frozen about $340,000 linked to the theft as of Sept. 29. Bitcoin has no issuer that can pull off the same trick.
Bitget says tracking and recovery are ongoing, and it dangles bounties worth 5% of funds successfully frozen or recovered for eligible voluntary contributors. Wasabi's own documentation describes its goal as severing the link between transaction inputs and outputs. Entering a CoinJoin, Arkham's numbers show, doesn't prove the coins are gone.
TopicsArkham · Bitget · BlockSec · THORChain · Tether · Circle · Wasabi CoinJoin · Bitcoin
Written by Paparazzi with AI. Not financial advice.