Arkham Tracks 66 CoinJoin Transactions Linked to Bitget Exchange Hacker Since Nov. 6

TLDR

Arkham says the Bitget hacker sent 847.26 BTC, worth $63.43 million, into CoinJoin since Nov. 6.
That amount made up about 80.5% of the 1,052.34 BTC that left the hacker’s wallets over six days.
About 959.29 BTC, worth $71.44 million, still sits in wallets Arkham links to the attacker.
Bitget’s own tracking tool shows 866.23 BTC in gross CoinJoin inputs, using a different method.
Bitget is offering a 5% bounty on any funds that are frozen or recovered.

The hacker behind the Bitget breach still controls about $71 million in bitcoin after sending a large share of recent outflows into a mixing service. Blockchain analytics firm Arkham shared the figures in an update published Nov. 11.
Arkham said wallets it links to the attacker moved 847.26 BTC, worth about $63.43 million, into CoinJoin transactions starting Nov. 6. In total, 1,052.34 BTC left its labelled hacker wallets over six days.
The CoinJoin amount made up about 80.5% of those outflows. Arkham’s snapshot showed 959.29 BTC, valued at $71.44 million, still sitting in the tracked wallets.
The firm noted this remaining balance is not a full count of everything the attacker may control. Other wallets outside its labels could hold more funds.
Arkham counted 66 transactions beginning at 4:27 a.m. ET on Nov. 6. Of the total, 579.80 BTC went straight into CoinJoin.
The other 267.46 BTC took a longer path. Those coins passed through fresh addresses in one to six transfers before entering the mixer.

Bitget Hacker Update: $78.6M of Bitcoin Moved This Week
1,052.34 BTC ($78.61M) has left the Bitget Hacker’s labelled wallets in the past six days. 847.26 BTC ($63.43M) of it entered CoinJoin transactions.
The wallets still hold 959.29 BTC ($71.44M). pic.twitter.com/Q1Yb49hEtV
— Arkham (@arkham) November 11, 2026

How the Mixing Works
CoinJoin combines bitcoin from many users into a single transaction. This makes it harder to tell which coins coming out belong to which person.
Wasabi, a wallet that runs CoinJoin, says in its documentation that the goal is to break the link between inputs and outputs. Still, entering a CoinJoin does not by itself mean the funds have been cashed out or can never be recovered.
Public bitcoin records support at least one early mixing transaction at 4:27 a.m. ET on Nov. 6. It had six inputs totaling 18 BTC, all from addresses on Bitget’s list of attacker addresses.
Bitget’s tracker labels that transaction as a Wasabi CoinJoin. The record confirms one example but does not independently prove Arkham’s full tally.
Two Different Counts
Bitget runs its own tracking API, which shows a different figure. It lists 72 CoinJoin transactions with 866.23 BTC in gross inputs from Nov. 6 through 6:58 a.m. ET on Nov. 11.
Bitget’s documentation warns that gross deposits can count the same coins twice if they enter another mixing round. Its net measure also leaves out funds later traced back out, so the two counts cannot be compared directly.
The exchange was breached on Sept. 24. Bitget’s latest accounting puts the loss at about $388 million.
After the attack, the stolen assets were converted into bitcoin. Security firm BlockSec reported in September that the funds were moved mainly through THORChain, a cross-chain swap protocol.
BlockSec also found that Tether and Circle had frozen about $340,000 in stablecoins tied to the theft as of Sept. 29. Stablecoin issuers can freeze balances at specific addresses, but bitcoin has no central authority that can do the same.
Bitget says its tracking and recovery work is still ongoing. The exchange is offering eligible voluntary contributors a bounty of 5% of any funds that are frozen or recovered.
The post Arkham Tracks 66 CoinJoin Transactions Linked to Bitget Exchange Hacker Since Nov. 6 appeared first on Blockonomi.