Wallets linked to the attacker behind Bitget’s $387.5 million September security breach transferred another $19.48 million in cryptocurrency across 52 transactions between October 21 and October 24, according to blockchain intelligence firm Arkham.
Bitcoin accounted for approximately $19.33 million of the latest movements, while Ether represented the remaining $150,000. Most of the cryptocurrency was sent to newly used addresses, complicating efforts to determine where the stolen assets may be heading.
The latest activity brings the value of transfers from Arkham-labeled attacker wallets to new addresses since October 15 to approximately $78.01 million. Meanwhile, wallets still attributed to the hacker hold an estimated $242.54 million in cryptocurrency.
Although the movements raise questions about possible laundering, investigators have not established that the latest transfers reached cryptocurrency exchanges, mixing services or other cash-out destinations.
Arkham Tracks $19.33 Million in Bitcoin Transfers
According to Arkham’s October 24 blockchain investigation, the 52 transfers occurred between 10:02 UTC on October 21 and 02:48 UTC on October 24.
Bitcoin represented approximately 99.2% of the transferred value, continuing a pattern in which the attacker has concentrated a substantial portion of the stolen cryptocurrency into BTC.
Most of the transfers went to fresh wallet addresses rather than destinations publicly identified as exchanges or laundering services. Such movements can make blockchain investigations more complicated by distributing funds across a larger network of addresses.
However, moving assets between wallets does not necessarily mean they have been sold, converted into privacy-focused cryptocurrencies or successfully laundered. The funds remain visible on public blockchains, and analysts may be able to follow their subsequent movements.
Arkham’s latest snapshot identified 2,960.01 BTC worth approximately $241.99 million in wallets still associated with the attacker. Smaller balances across Ethereum, Hypercore, Solana and Tron brought the tracked total to $242.54 million.
Hacker-Linked Wallets Have Moved $78 Million Since October 15
The latest transactions form part of a broader redistribution of stolen assets that began accelerating earlier in October.
Arkham identified approximately $23.31 million in transfers on October 15, followed by $8.68 million on October 16 and $1.15 million on October 17. Another $10.51 million moved on October 18, before activity paused on October 19.
Transfers resumed with approximately $15.13 million on October 20, $11.74 million on October 21, $184,160 on October 22 and $7.3 million on October 23.
Together, the activity amounted to approximately $78.01 million sent to new addresses over the reporting period. The $19.48 million identified in the latest 52 transfers overlaps with this broader activity and should not be added to it as a separate loss.
The remaining $242.54 million in Arkham-labeled wallets represents approximately 63% of Bitget’s revised $387.5 million theft estimate. However, this comparison does not establish how much cryptocurrency has been recovered, as wallet balances change with market prices and some assets may have moved beyond currently attributed addresses.
Bitget’s $387.5 Million Hack Began With a Third-Party Security Flaw
The original attack occurred on September 24, when unauthorized transfers drained cryptocurrency from portions of Bitget’s hot and warm wallet infrastructure.
The exchange initially estimated losses of approximately $351.6 million before revising the figure to $387.5 million after identifying additional affected assets on Zcash and Tron.
Bitget’s subsequent investigation found that the attacker exploited a vulnerability in a third-party security product, obtained internal credentials and submitted fraudulent withdrawal instructions that bypassed existing controls. The exchange said private keys and cold wallets were not compromised.
Bitget maintained that customer account balances remained unaffected because its Protection Fund absorbed the financial impact. The exchange subsequently replenished the fund to more than $300 million and completed its phased restoration of withdrawal services on October 2.
Dave Finances previously covered Bitget’s restoration of Bitcoin withdrawals and the movement of approximately $169 million in Protection Fund Bitcoin toward operational wallets following the breach.
Bitget has said the original security vulnerability was remediated and that no additional unauthorized withdrawals occurred after containment. The October wallet movements therefore represent activity involving previously stolen assets, rather than evidence of a new exchange breach.
Earlier Transfers Used Chainflip, CoinJoin and Zcash
The October transfers are not the first attempt to redistribute cryptocurrency associated with the Bitget attacker.
During September, investigators documented funds moving through cross-chain swap services and Bitcoin addresses. One transaction involving Chainflip was rejected by a broker, preventing the attempted conversion from completing and returning the assets to their originating address.
Another investigation traced approximately 4 BTC linked to the theft into Wasabi CoinJoin transactions after a sequence of conversions involving Tron, Ethereum and Bitcoin.
Separately, blockchain researchers identified stolen Zcash moving into the network’s shielded pool, including a 2,746 ZEC transfer into Ironwood reported on September 30.
Those earlier movements demonstrate that some assets linked to the attacker have previously passed through privacy-enhancing mechanisms. They do not, however, establish that the latest $19.48 million followed the same routes.
Why Moving Stolen Bitcoin Matters for Recovery Efforts
The amount of cryptocurrency still associated with the attacker creates a difficult situation for investigators. More than a month after the original breach, substantial funds remain under addresses attributed to the theft, while new transactions continually expand the network that must be monitored.
Redistributing Bitcoin across dozens of wallets can serve several purposes. An attacker might be preparing assets for exchange deposits, over-the-counter transactions, cross-chain swaps or simply longer-term storage under a different set of addresses.
From the outside, those possibilities can initially look similar. A transfer into a fresh wallet does not reveal whether the owner intends to sell the cryptocurrency tomorrow, hold it for months or move it through another service.
That is why the absence of a confirmed destination matters. Labeling the latest activity as completed laundering would go beyond what Arkham’s findings establish.
For investigators, Bitcoin’s transparent transaction history remains useful. The movement of funds can be followed between addresses, although determining the person or organization controlling the receiving wallets is a separate challenge.
The more significant recovery opportunities often arise when stolen cryptocurrency interacts with identifiable businesses. Exchanges and service providers may have customer records, compliance controls and mechanisms for restricting suspicious accounts. Native Bitcoin, by contrast, cannot simply be frozen by a token issuer.
Bitget’s Recovery Challenge Is Far From Over
For Bitget users, the immediate financial consequences have been limited by the exchange’s stated decision to absorb the losses. But protecting customer balances and recovering stolen cryptocurrency are two different achievements.
The exchange has already restored withdrawals and replenished its Protection Fund. What remains unresolved is how much of the original $387.5 million can ultimately be traced, frozen or returned.
The latest transfers also show why exchange security incidents can remain active investigations long after normal operations resume. Once stolen assets enter attacker-controlled wallets, the movement of those funds can continue for months, independently of whether the original vulnerability has been fixed.
For the wider cryptocurrency industry, the case highlights an uncomfortable reality: public blockchains make transactions observable, but that transparency does not automatically translate into recoverability.
Arkham’s October 24 findings provide a clearer picture of where part of the stolen portfolio has moved. The next meaningful development would be evidence that the funds reached an identifiable service, were converted through a privacy mechanism or became subject to a recovery action.
Until then, the $19.48 million movement is best understood as another stage in the redistribution of assets stolen in September, not confirmation that the attacker has successfully cashed out.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574