The thief behind September’s Bitget exchange hack has started running stolen Bitcoin through CoinJoin, and the pace is picking up. Blockchain analytics firm Arkham Intelligence says 1,052.34 BTC, worth about $78.6 million, left the hacker’s labelled wallets between Nov. 6 and Nov. 11.
Of that, 847.26 BTC went into 66 CoinJoin transactions. That is roughly 80% of everything moved during the six days.
Another 959.29 BTC, worth about $71.4 million, has not moved yet and still sits in addresses anyone can watch.
The bigger story here is not only where the coins are going. It is how precisely an open ledger lets the public follow them.
How the Bitget Hack Unfolded
According to Arkham, Bitget was drained of about $350 million between 18:31 and 21:23 UTC on Sept. 24. Five wallets were compromised across seven chains, and Arkham labelled 26 hacker addresses within the first day.
For several weeks, the stolen funds mostly sat still. By Oct. 24, Arkham said $242.54 million, or 69% of the haul, was still in the labelled wallets, with 2,960.01 BTC making up almost all of it.
The coins then began to trickle out. Arkham counted $78.01 million sent to new addresses between Oct. 15 and Oct. 23, and its Oct. 24 update flagged $19.48 million moved in 52 transfers over the previous three days, nearly all of it Bitcoin.
That earlier phase looked like simple shuffling to fresh addresses. The November activity is different.
Why CoinJoin Changes the Picture
A CoinJoin is a single Bitcoin transaction that combines inputs from many participants and pays out matching amounts to new addresses. Because the outputs look alike, outside observers lose the obvious link between who paid in and who got paid.
Arkham says the hacker’s coins began entering CoinJoin transactions at 09:27 UTC on Nov. 6. It traced 579.80 BTC sent in directly from labelled wallets and another 267.46 BTC routed through one to six fresh addresses first.
The remaining 205.08 BTC moved without passing through CoinJoin, according to Arkham’s totals. Those coins can still be followed hop by hop.
We think it is worth separating the tool from this user. CoinJoin is an open, long-standing privacy technique used by ordinary holders who would rather not publish their entire financial history. A criminal using it does not make the method itself criminal, any more than a getaway car indicts the road.
The Bitget Hacker Is Moving Faster Each Day
The daily numbers show a clear acceleration. Arkham recorded 137.71 BTC leaving on Nov. 6 and 156.04 BTC on Nov. 7, before a near pause of 16.75 BTC on Nov. 8.
Then the flow climbed for three straight days: 206.31 BTC on Nov. 9, 238.79 BTC on Nov. 10 and 296.74 BTC on Nov. 11. The last figure only runs to 11:58 UTC, so the full day was likely higher.
Arkham puts the average since Nov. 6 at 175.39 BTC a day. If that pace held, the remaining 959.29 BTC would clear in under six days. At the Nov. 11 rate, it would take closer to three.
That is arithmetic, not a forecast. The hacker could slow down, pause or change routes at any time, as the near-quiet Nov. 8 showed.
Is This Pressure on the Bitcoin Price?
We do not see it that way. Coins entering a CoinJoin are being reshuffled between addresses, not sold on an exchange order book.
Scale matters too. CoinGecko data showed about $26.1 billion in Bitcoin trading over the 24 hours to late Nov. 11, roughly 350,700 BTC. The hacker’s busiest day was less than 0.1% of that.
Bitcoin traded near $74,330 at the time, up about 0.9% on the day, according to CoinGecko. The market has been working through a softer patch, but a few hundred mixed coins a day are not what moves it.
The more relevant point for investors is where the failure happened. This was an exchange’s hot and cold wallet setup being breached, not a flaw in Bitcoin itself. As we noted when Ledger’s chief executive argued that everybody will eventually be hacked, concentrated custodial balances remain the biggest target in crypto.
What an Open Ledger Makes Possible
Every figure in this story, down to the minute the first CoinJoin began, comes from data any member of the public can check. That is the part of the episode we find most telling.
In traditional finance, stolen money tends to vanish into private bank records that only investigators with subpoenas can see. On Bitcoin, the trail is published, time-stamped and permanent.
It is the same transparency that let analysts trace other stolen funds as they were converted into Bitcoin earlier this month. Mixing makes the job harder, but the 205.08 unmixed coins and the 959.29 still parked are all in plain view.
For holders, the lesson is familiar and practical. Large balances sitting on any single platform are a standing target, while keys you control yourself are not exposed to an exchange’s next breach.
The coming days will show whether the hacker drains the remaining wallets at the current pace. Either way, every move will land on a ledger that never forgets, which is exactly why Bitcoin’s design keeps earning trust even when the businesses around it stumble.
DC Forecasts is a leader in many crypto news categories, striving for the highest journalistic standards and abiding by a strict set of editorial policies. If you are interested to offer your expertise or contribute to our news website, feel free to contact us at [email protected]
Discussion about this post