Arkham Traces $63 Million in Bitget Hack Funds to CoinJoin

By Tom Whitfield

Arkham said it traced roughly $63 million from the Bitget hack into CoinJoin transactions. The amount represented about 80.5% of 1,052.34 BTC that left its labelled hacker wallets over six days, according to its update on X. Bitget’s latest accounting puts the cost of the Sept. 24 breach at approximately $388 million.

Its snapshot showed 959.29 BTC remaining in those wallets, valued at $71.44 million, without accounting for everything the attacker might still control. BlockSec reported in September that attackers were consolidating stolen assets into BTC, mainly through the cross-chain swap protocol THORChain. Arkham’s mixing data followed that conversion.

Can stablecoin freezes slow bitcoin recovery?

BlockSec’s September analysis found that Tether and Circle had frozen about $340,000 in stablecoins linked to the theft as of Sept. 29. Those issuers can freeze token balances at specified addresses. Bitcoin has no equivalent central authority.

Mixing adds a separate obstacle: Wasabi’s documentation describes its goal as breaking the link between transaction inputs and outputs. Entering a CoinJoin transaction does not, by itself, establish that funds have been cashed out or become unrecoverable.

What do the Bitcoin records show?

Bitcoin transaction data corroborate an early mixing transaction at 4:27 a.m. ET on Nov. 6. Six inputs totaling 18 BTC came from addresses on Bitget’s attacker-address list, and Bitget’s tracker classified the transaction as Wasabi CoinJoin. The record confirms one example, rather than independently establishing Arkham’s complete tally.

Bitget’s separate tracking API lists 72 CoinJoin transactions with 866.23 BTC in gross inputs from Nov. 6 through 6:58 a.m. ET on Nov. 11. Bitget’s documentation warns that gross deposits can count coins again when they enter another mixing round.

Its net measure excludes funds subsequently traced out, so neither measure is interchangeable with Arkham’s wallet-outflow tally.

What remains in the recovery pipeline?

Bitget says fund tracking and recovery remain ongoing. It offers eligible voluntary contributors bounties equal to 5% of funds successfully frozen or recovered.

The recovery window remains open while further tracing tests whether Bitget’s gross and net measures align with Arkham’s 1,052.34 BTC outflow figure. Without a central freezing authority, bitcoin recovery depends on identifying counterparties and voluntary cooperation. Bitget’s approximately $388 million Sept. 24 loss remains the reference point for recovery efforts and bounty payouts.