Bitget Hacker Moves $78.61M in Bitcoin Over Six Days

Wallets tied to the September breach of crypto exchange Bitget have moved $78.61 million in Bitcoin over six days, according to on-chain data tracked by analytics platform Arkham. The transfers mark the most sustained movement of stolen funds since the Sept. 24 incident, which Bitget now values at $387.5 million.

When did the outflows peak?

Daily transfers fell to a low of 16.75 BTC on Nov. 8 before climbing for three consecutive days. The largest single-day movement came on Nov. 11, when 296.74 BTC worth $21.83 million left the labeled wallets by 11:58 UTC.

Arkham tracked a further 205.08 BTC in other transfers during the period. Of that amount, 172.33 BTC remained unspent across 250 addresses as of the latest data. The labeled wallets still held $71.86 million, with Bitcoin accounting for more than 99% of that balance.

The pattern suggests the attacker is dispersing funds across a growing number of addresses rather than consolidating them, a tactic that complicates freezing efforts by exchanges and law enforcement.

How much was actually stolen?

Bitget initially valued the assets taken in the Sept. 24 breach at $351.6 million. The exchange later raised that figure to $387.5 million after counting Zcash and TRON assets it had omitted from the first tally.

The breach ranks among the largest exchange exploits of the year. Bitget said in September that it had fixed the exploited vulnerability and was working with Mandiant, Google's incident-response unit, and blockchain security firm SlowMist on the investigation.

How is Bitget pursuing recovery?

Under its recovery program, Bitget offers eligible participants 5% of the funds they directly help freeze. A separate 5% reward applies to funds participants directly help recover. The two-tier structure effectively pays out up to 10% on assets a contributor both freezes and helps claw back.

The bounty framework signals Bitget expects recovery to run through third parties — other exchanges, chain-analysis firms or researchers — rather than through unilateral action. Dispersal of funds across 250 addresses raises the operational cost of that approach, since each freezing request typically requires a separate legal or compliance process.

What happens next?

The unspent 172.33 BTC sits at addresses that investigators and bounty participants can still monitor in real time. Whether Bitget freezes a meaningful share of the remaining $71.86 million will depend on how quickly exchanges receiving the dispersed funds act on tracing alerts before the attacker converts the holdings.