Bitget hacker fund movements top $78.01 million in transfers to new addresses

What it is

An Arkham-based tracking report on the Bitget exchange hacker's wallets, published 24 October 2026. Arkham recorded $19.48 million moved in 52 transfers between 10:02 UTC on 21 October and 02:48 UTC on 24 October, a window of 64 hours 46 minutes. Bitcoin was $19.33 million of that, with ETH the remainder. Almost all of it went to new addresses.

Figures the summary omits

Arkham's daily totals sent to new addresses, 15 to 23 October, sum to the $78.01 million:

Remaining labeled holdings are $242.54 million. Of that, 2,960.01 BTC is worth $241.99 million. Smaller balances sit on Ethereum, Hypercore, Solana and Tron.

Loss baselines

Arkham calls the holdings 69% of its own $350 million theft estimate. Bitget's figure is about $387.5 million, revised from $351.6 million. Its 25 September recovery notice says the revision added Zcash and TRON assets left out of the first count, not new theft. Against Bitget's figure the holdings are about 62.6%. The page says these ratios compare remaining labeled assets with original loss estimates and are not recovery totals.

Laundering routes (September)

• AMLBot followed about 4 BTC into Wasabi CoinJoin.
• AMLBot also traced TRON to USDT, then to Ethereum via USDT0, then ETH swaps and THORChain into Bitcoin. About 4.59 BTC came out and was split into smaller amounts.
• Bitquery matched 66 THORChain and Chainflip swaps to 126.71 BTC in payments by 14:38 UTC on 25 September, with two swaps still pending.

What to do

For responders and exchanges, Bitget's 25 September notice publishes receiving addresses on Ethereum-compatible networks, XRP Ledger, Zcash and TRON. It names Mandiant and SlowMist as investigators and says some assets are already frozen. Bitget pays a separate 5% reward for qualifying voluntary actions that freeze or recover the assets. Actions under court orders, law-enforcement requests or other legal processes are excluded, and Bitget keeps discretion over eligibility and payment.

Caveats

Bitget says the root cause was a flaw in a third-party security product. The attacker got high-level internal credentials and issued fraudulent withdrawal commands that bypassed risk controls. The page names neither the product nor the vendor, and gives no technical detail. Bitget says customer balances are unaffected, withdrawals fully reopened on 2 October, and its Protection Fund (over $300 million per CEO Gracy Chen) will absorb the loss. The page notes that a later post described the transfers as "the past 48 hours", which does not match Arkham's timestamps.