A wallet labeled as belonging to the Bitget hacker moved $78.61 million in Bitcoin over the past six days. Data from blockchain tracking platform Arkham indicates that the flow of stolen assets has begun branching into multiple separate transaction routes.
A total of 80.5% of the transferred funds, or 847.26 BTC worth $63.43 million, was routed into CoinJoin privacy transactions. The transfers utilized the WabiSabi protocol, which breaks the direct link between transaction inputs and outputs on the blockchain ledger.
This obfuscation process did not take place in a single stage, but was instead broken down into multi-layered transfer routes.
How 847 Bitcoin Entered the Privacy Mixer
Of the 847.26 BTC routed to CoinJoin, 579.80 BTC worth $43.59 million was sent directly from the hacker’s labeled wallet. Meanwhile, the remaining 267.46 BTC worth $19.84 million was channeled through new intermediary addresses, passing through one to six hops before entering the privacy protocol.
Outflows averaged 175.39 BTC (around $13.10 million) per day since November 6, 2026. The pace of withdrawals accelerated daily, recording 206.31 BTC on November 9 and 238.79 BTC on November 10. That daily figure more than doubled compared to the initial movement volume.
The largest single-day movement occurred on November 11, 2026. Before 11:58 UTC, the hacker’s wallet withdrew 296.74 BTC worth $21.83 million on that day alone.
The Maya Protocol Route and Remaining Balances
Beyond CoinJoin, the hacker also directed stolen funds to other platforms. A total of 10 BTC worth $760,000 was transferred to Maya Protocol. At the same time, the hacker split 4.37 BTC worth $330,500 into 433 small-value transactions.
The remaining portfolio in the hacker’s wallet currently includes 241,026 USDT, 134,456 USDC, and 18.358 ETH. The same wallet also still holds small balances of TRX and USDD.
The laundering operation stems from the Bitget exchange hack on September 24, 2026. The initial loss of $351.6 million was revised upward to $387.5 million after accounting for missing Zcash and TRON assets.
Laundering Syndicate’s Trail on Social Media
On-chain investigator @zachxbt revealed that the laundering operation involves an external crime syndicate. The findings disclosed that Chinese actors assisted in laundering the Bitget funds on behalf of DPRK hackers.
The intermediary actors even openly solicited help fulfilling orders in public Discord and Telegram servers. This move highlights how money laundering networks leverage mainstream communication channels to coordinate large-volume transactions.
For on-chain analysts, severing technical transaction links via privacy protocols like CoinJoin is not the end of the tracking trail. The carelessness of the facilitator network on public platforms like Discord and Telegram has instead provided investigators with concrete breadcrumbs to map out the criminal syndicate behind the hack.
Via crypto.news.
Also read: Across Urges Users to Avoid App - Wallet Balances Drained After Interacting With Bridge
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
