Arkham Intelligence reported that the hacker behind crypto exchange Bitget moved $19.48 million worth of assets across 52 separate transactions. The series of transfers unfolded over three days, beginning on October 21 at 10:02 UTC and concluding on October 24, 2026, at 02:48 UTC.
Almost all of the transferred assets were in Bitcoin, totaling $19.33 million, with the remainder in Ethereum valued at approximately $150,000. All transactions were routed to a batch of previously unknown new addresses, with no identified involvement of crypto exchanges, transaction mixers, or recipient over-the-counter desks.
Where the $19 Million Flow Went
The 52 transfers recorded by Arkham landed in newly created recipient wallets. On-chain data indicates that none of the receiving addresses are linked to registered exchanges or financial entities. All the Bitcoin and Ethereum funds are now scattered across anonymous addresses with no subsequent movement toward centralized platforms.
Beyond the $19.48 million recently transferred, the wallet tagged as the Bitget exploiter still retains a vastly larger balance. Arkham notes that the remaining stolen assets held at the attacker’s address stand at $242.54 million. The bulk consists of 2,960.01 BTC worth $241.99 million, alongside smaller token balances across the Ethereum, Hypercore, Solana, and Tron networks.
The $242.54 million figure also updates Arkham’s previous tally of $239.34 million. The increase in the hacker’s portfolio value was driven by market fluctuations in the price of Bitcoin, rather than additional coins entering the wallet.
Obfuscation Trail Since the September Breach
The security breach at Bitget took place in September 2026, at which point the exchange estimated total stolen assets at $387.5 million. According to Arkham’s data, the $242.54 million still sitting in the attacker’s hands accounts for roughly 62.6% of the exchange’s initial estimated losses.
Bitget explained that the attacker acquired high-level internal credentials by exploiting a vulnerability in a third-party product. Armed with that access, the perpetrator submitted forged withdrawal requests that slipped past the exchange’s risk-control filters.
Efforts to obscure the stolen assets date back to September. Blockchain analytics firm AMLBot traced around 4 BTC sent to privacy protocol CoinJoin as part of the hacker’s attempt to muddy the trail. During the same period, Bitquery documented 66 asset swaps executed through decentralized protocols THORChain and Chainflip.
Recovery Status and User Protection
Following the breach, Bitget engaged cybersecurity firms Mandiant and SlowMist to conduct an in-depth investigation. Withdrawal services for users were fully restored on October 2, 2026, after the exchange reopened processing for Bitcoin, Ethereum, and USDT.
Bitget Chief Executive Officer Gracy Chen stated that the exchange’s Protection Fund had climbed back above $300 million as of September 30, 2026.
For Bitget users, withdrawal operations have returned to normal and reserve protections have been replenished. However, with $242.54 million still parked in the hacker’s wallets, the vast majority of the loot from the September attack remains outside the exchange’s reach.
Via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
