Key Takeaways
- • Arkham Intelligence tracked $19.48 million across 52 transfers from the Bitget hacker between October 21 and October 24, 2026, with Bitcoin accounting for $19.33 million of that outflow.
- • Fund movements to new addresses totaled $78.01 million from October 15 through October 23, 2026, per Arkham's daily breakdown.
- • Arkham valued the attacker's remaining labeled holdings at $242.54 million, including 2,960.01 BTC worth $241.99 million, roughly 69% of its $350 million theft estimate.
- • Bitget's revised loss estimate is approximately $387.5 million, up from an initial $351.6 million, attributed to the inclusion of Zcash and TRON assets omitted from the first calculation.
- • Bitget completed its phased withdrawal restoration on October 2, states customer account balances are unaffected, and says its Protection Fund will absorb the financial loss.
Summary
Blockchain intelligence firm Arkham reported that fund movements linked to the Bitget hacker reached $19.48 million across 52 transfers between October 21 and October 24, 2026. Nearly all of that value moved in Bitcoin, with Bitcoin accounting for $19.33 million and ETH making up the remainder. Arkham recorded the latest transfers between 10:02 UTC on October 21 and 02:48 UTC on October 24, and nearly all of the funds were sent to new addresses.
For the broader period from October 15 through October 23, Arkham put transfers to new addresses at $78.01 million. Daily figures included $23.31 million on October 15, $8.68 million on October 16, $1.15 million on October 17, $10.51 million on October 18, no movement on October 19, $15.13 million on October 20, $11.74 million on October 21, $184,160 on October 22 and $7.3 million on October 23.
According to Arkham's snapshot, the attacker's remaining labeled assets carried a total valuation of $242.54 million, including 2,960.01 BTC worth $241.99 million. Smaller balances appeared on Ethereum, Hypercore, Solana and Tron. Arkham described these holdings as 69% of its $350 million theft estimate. Bitget uses a different baseline of approximately $387.5 million, revised from its initial $351.6 million calculation in its September 25 recovery notice. Against Bitget's figure, Arkham's holdings represent approximately 62.6%. These comparisons measure remaining labeled assets against estimates of the original loss and are not recovery totals.
Earlier investigations traced the stolen assets through CoinJoin and cross-chain services. In September, AMLBot followed roughly four BTC into CoinJoin via Wasabi, and separately traced a route from TRON through USDT0 and Ethereum, then THORChain transfers into Bitcoin, yielding about 4.59 BTC. Bitquery documented September conversions through THORChain and Chainflip, matching 66 swaps to 126.71 BTC in payments as of 14:38 UTC on September 25.
Bitget attributed the breach to a flaw in a third-party security product, stating the attacker obtained high-level internal credentials and issued fraudulent withdrawal commands that bypassed risk controls. The exchange said it isolated the affected systems and fixed the vulnerability, and that it identified no further unauthorized transfers after containment. Bitget completed its phased withdrawal restoration on October 2 after reopening BTC, ETH and USDT services during September. CEO Gracy Chen said the Protection Fund exceeded $300 million again on September 30, and Bitget said the fund would absorb the loss. The recovery notice named Mandiant and SlowMist as investigation partners, said coordination with industry partners had frozen some assets, and offers a 5% reward for qualifying voluntary actions that freeze or recover assets, excluding court-ordered or law-enforcement actions.
For the broader period from October 15 through October 23, Arkham put transfers to new addresses at $78.01 million. Daily figures included $23.31 million on October 15, $8.68 million on October 16, $1.15 million on October 17, $10.51 million on October 18, no movement on October 19, $15.13 million on October 20, $11.74 million on October 21, $184,160 on October 22 and $7.3 million on October 23.
According to Arkham's snapshot, the attacker's remaining labeled assets carried a total valuation of $242.54 million, including 2,960.01 BTC worth $241.99 million. Smaller balances appeared on Ethereum, Hypercore, Solana and Tron. Arkham described these holdings as 69% of its $350 million theft estimate. Bitget uses a different baseline of approximately $387.5 million, revised from its initial $351.6 million calculation in its September 25 recovery notice. Against Bitget's figure, Arkham's holdings represent approximately 62.6%. These comparisons measure remaining labeled assets against estimates of the original loss and are not recovery totals.
Earlier investigations traced the stolen assets through CoinJoin and cross-chain services. In September, AMLBot followed roughly four BTC into CoinJoin via Wasabi, and separately traced a route from TRON through USDT0 and Ethereum, then THORChain transfers into Bitcoin, yielding about 4.59 BTC. Bitquery documented September conversions through THORChain and Chainflip, matching 66 swaps to 126.71 BTC in payments as of 14:38 UTC on September 25.
Bitget attributed the breach to a flaw in a third-party security product, stating the attacker obtained high-level internal credentials and issued fraudulent withdrawal commands that bypassed risk controls. The exchange said it isolated the affected systems and fixed the vulnerability, and that it identified no further unauthorized transfers after containment. Bitget completed its phased withdrawal restoration on October 2 after reopening BTC, ETH and USDT services during September. CEO Gracy Chen said the Protection Fund exceeded $300 million again on September 30, and Bitget said the fund would absorb the loss. The recovery notice named Mandiant and SlowMist as investigation partners, said coordination with industry partners had frozen some assets, and offers a 5% reward for qualifying voluntary actions that freeze or recover assets, excluding court-ordered or law-enforcement actions.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.