Arkham says 1, 052.34 BTC left wallets it attributed to the Bitget breach between Nov. 6 and Nov. 11, with about 80.5% entering CoinJoin transactions. The wallet attribution and transaction classifications are Arkham’s. The available figures do not establish who controlled every address or what ultimately happened to the funds.
- Arkham valued the reported outflows at $78.61 million.
- According to Arkham, 847.26 BTC entered 66 CoinJoin transactions.
- A separate snapshot showed 959.29 BTC in tracked wallets, though its date and scope are unclear.
- The year for the November dates is not specified.
What Arkham Reported
In an update dated Nov. 12, Arkham said 1, 052.34 BTC left wallets it labeled as linked to the Bitget attacker between Nov. 6 and Nov. 11. The firm valued the outflows at $78.61 million and reported an average of 175.39 BTC per day.
The available update details do not give the year, so the dates cannot be placed on a confirmed calendar-year timeline. Arkham’s dollar valuations are estimates and can change over time. The report does not specify a common valuation time or pricing method.
Arkham reported these daily outflows:
- Nov. 6: 137.71 BTC
- Nov. 7: 156.04 BTC
- Nov. 8: 16.75 BTC
- Nov. 9: 206.31 BTC
- Nov. 10: 238.79 BTC
- Nov. 11: 296.74 BTC by 11:58 UTC
Arkham classified 847.26 BTC, about 80.5% of the reported outflows, as entering 66 CoinJoin transactions. The firm valued the Bitcoin routed into those transactions at $63.43 million. Activity began at 09:27 UTC on Nov. 6.
The available details do not explain how Arkham identified or classified the 66 transactions. The figures should be read as Arkham’s tracing findings, not independent confirmation of ownership or transaction intent.
What CoinJoin Does, and Does Not, Show
CoinJoin is a method for coordinating Bitcoin transactions. Multiple participants combine their inputs and create outputs, making it harder to match a particular input to a particular output. This can complicate blockchain analysis, but it does not make Bitcoin transactions invisible or prove that funds can no longer be traced.
Arkham said 579.80 BTC went directly from wallets it had labeled to CoinJoin transactions. Another 267.46 BTC first passed through fresh addresses, meaning addresses newly used in the traced paths, before reaching CoinJoin. Arkham said those transfers took one to six hops, or one to six movements between addresses. The two amounts add up to the reported 847.26 BTC. Direct transfers accounted for about 68.4% of that total.
CoinJoin use alone does not prove criminal intent, successful concealment or a cash-out. The available figures do not identify who controlled each destination address or establish whether investigators could trace the funds further.
Other Movements and a 2 BTC Gap
Arkham classified 205.08 BTC, valued at $15.18 million, as moved but not CoinJoined. Its listed categories were 172.33 BTC unspent across 250 addresses, 16.38 BTC still moving at six hops, 10 BTC sent to Maya Protocol, and 4.37 BTC distributed across 433 small outputs. Maya Protocol is a cross-chain liquidity protocol. The listing does not establish what happened to the 10 BTC afterward.
The listed categories add up to 203.08 BTC, which is 2 BTC short of Arkham’s stated non-CoinJoined total. That stated total matches the difference between all reported outflows and the CoinJoin amount, but Arkham does not explain the missing 2 BTC in its category breakdown.
What the Balance Figures Can, and Cannot, Tell Us
In a separate snapshot, Arkham reported 959.29 BTC, valued at $71.44 million, in the tracked wallets. It also put the value of the broader labeled-wallet portfolio, which included other assets, at $71.86 million. The snapshot date, wallet coverage and valuation method are not specified, so the remaining balance should not be treated as a complete accounting of the reported outflows.
Arkham’s dashboard classified about $339, 320 as frozen and $71.52 million as liquid. The criteria for those labels are not given. Bitget has separately said some assets affected by the September breach were frozen through coordination with industry partners. That does not show whether any Bitcoin in Arkham’s November tracking was among them.
Bitget’s Breach and Recovery Program
The reported Bitcoin movements followed Bitget’s Sept. 24 breach. Bitget first valued the affected assets at $351.6 million, then revised the total value of transferred assets to $387.5 million. The exchange said the higher figure included Zcash and TRON assets omitted from its first calculation, not additional unauthorized withdrawals. This confirms Bitget’s explanation, but it is not an independent audit of the breach total.
Bitget named Mandiant and SlowMist as investigation partners and said it had identified and fixed the underlying vulnerability. Those claims come from Bitget’s notice, not from independent assessments of the incident or its later status.
Bitget’s recovery program offers eligible participants 5% of funds they directly help freeze and a separate 5% of funds they directly help recover. Bitget decides who qualifies, what counts as a contribution and whether to pay, so the program does not guarantee a reward. Actions taken under court orders, law-enforcement requests or other legal processes are excluded.
Key Questions and Takeaways
-
How much Bitcoin did Arkham say moved?
Arkham reported that 1, 052.34 BTC, valued at $78.61 million, left wallets it attributed to the Bitget attacker between Nov. 6 and Nov. 11. The year is not specified.
-
How much entered CoinJoin?
Arkham classified 847.26 BTC, about 80.5% of the outflows, as entering 66 CoinJoin transactions. That classification does not establish that the Bitcoin became untraceable.
-
How much remained, and were funds recovered?
A separate Arkham snapshot showed 959.29 BTC in tracked wallets, but its date and scope are unclear. The available figures do not establish whether the reported Bitcoin was frozen or recovered.
-
What is the 2 BTC discrepancy?
Arkham’s stated non-CoinJoined total is 205.08 BTC, while its listed categories add up to 203.08 BTC. Arkham provides no explanation for the difference.
Arkham’s figures show substantial movement and widespread CoinJoin use among the Bitcoin it tracked. The wallet attribution, the 2 BTC gap and the funds’ ultimate status remain unresolved. Bitcoin’s growing institutional investment does not change the need for clear evidence about who controlled these funds or where they went.
