Bitget Hacker Moves $78.61M in Bitcoin (BTC) Through CoinJoin

CoinJoin Absorbs 80.5% of Hacker Outflows

Most of the Bitget hacker's Bitcoin (BTC) now sits inside CoinJoin transactions rather than on any exchange: on-chain data from Arkham shows $63.43 million of the hacker's coins entered the privacy transactions after 1,052.34 BTC, worth $78.61 million, left the labeled wallets across six days. The flows began at 09:27 UTC on Nov. 6, and 847.26 BTC, about 80.5% of the stolen Bitcoin moved, ended up in 66 CoinJoin transactions. Of that inflow, 579.80 BTC worth $43.59 million came straight from the labeled crypto wallets, while 267.46 BTC valued at $19.84 million first ran through fresh wallet addresses, one to six hops deep, a chain-of-addresses pattern typical of HD wallet derivation, before reaching the same transactions; direct transfers thus account for roughly 68.4% of the CoinJoin volume. A CoinJoin combines many participants' inputs into one transaction and hands back outputs that cannot be matched one-to-one with the inputs, breaking the trail a normal transfer leaves. The daily record shows acceleration after a lull: 137.71 Bitcoin (BTC) ($10.47 million) left on Nov. 6, 156.04 BTC ($11.86 million) on Nov. 7 and only 16.75 BTC ($1.27 million) on Nov. 8, then 206.31 BTC on Nov. 9, 238.79 BTC on Nov. 10 and 296.74 BTC on Nov. 11. Average outflows since Nov. 6 stand at 175.39 BTC, or $13.10 million, a day, per the firm's Nov. 11 tracking thread. The final day was the largest of the period at $21.83 million, more than twice the Nov. 6 total, even though its reporting cutoff fell at 11:58 UTC, before midday. Arkham valued the coins at the prevailing Bitcoin price, so each dollar figure moves with the market as well as with the volumes, and its labels are what tie these wallets to the theft in the first place.

WabiSabi Design and the Unmixed Remainder

CoinJoin of this kind pools inputs by design: the WabiSabi protocol behind Wasabi-style mixing combines participants' Bitcoin inputs into shared transactions and creates outputs that leave no direct input-to-output link visible to the coordinator or to fellow participants, which is why such transfers resist simple tracing. Tracing teams had seen the technique at far smaller scale before: in September, AMLBot linked roughly four Bitcoin (BTC) to CoinJoin after following stolen funds from TRON through USDT0, Ethereum and THORChain, a route it described as an apparent effort to obscure the assets. The unmixed remainder is smaller but not idle: 205.08 BTC, worth $15.18 million, moved without entering CoinJoin. Of that, 172.33 BTC worth $12.72 million sits unspent across 250 addresses, 16.38 BTC valued at $1.22 million was still moving at six hops, 10 BTC worth $760,000 reached Maya Protocol, and 4.37 BTC worth $330,500 is scattered across 433 small outputs. What remains in the labeled wallets is almost entirely Bitcoin: more than 99% of a $71.86 million portfolio, with $339,320 classified as frozen and $71.52 million as liquid, alongside 241,026 USDT, 134,456 USDC, 18.358 ETH and smaller TRX and USDD balances. The movement traces back to the Sept. 24 breach of Bitget, first valued at $351.6 million and later revised to $387.5 million in transferred assets; the exchange's official investigation update says the revision covered Zcash and TRON holdings left out of the first calculation, not further unauthorized withdrawals. Bitget named Mandiant and SlowMist as investigation partners, said the underlying vulnerability has been found and patched, and set a recovery bounty that splits rewards into two 5% grants, one for direct help in freezing funds and one for direct help in recovering them, with the company deciding eligibility and court-ordered actions excluded. Readers weighing exposure to the venue can follow the beginner walkthrough of how to buy Bitcoin on Bitget before depositing.

Holdings Down to 959.29 BTC

The shape of the week argues for deliberate obfuscation ahead of any cash-out rather than hasty dispersion: CoinJoin dominates the flows, routing runs through fresh addresses hop by hop, and no exchange appears anywhere in the traced path. Tracked holdings have fallen from 2,960.01 BTC, valued at $242.54 million, at the October snapshot, when $19.48 million had moved between Oct. 21 and Oct. 24 with no exchange or mixer identified, to 959.29 BTC at the latest count. For Bitget's bounty program, coins already inside CoinJoin pools are the hardest to freeze, which raises the value of early reporting. As of the latest snapshot on Nov. 11, the wallets still held 959.29 BTC worth $71.44 million, and the traced funds sit there, in CoinJoin pools and holding wallets, not at any named venue.