Blockchain investigators have identified fresh movements involving cryptocurrency linked to earlier thefts, alongside a major Bitcoin deposit from a previously dormant wallet. In today’s crypto roundup, Arkham reports that $63.43 million in Bitcoin associated with the September Bitget breach entered CoinJoin transactions, Lookonchain traces a $3.4 million DAI-to-Ether conversion connected to the earlier TLBL wallet theft, and a Bitcoin holder inactive for roughly four years transfers nearly $74 million to Binance. The developments span November 11 and 12, although none independently establishes a completed cash-out or a new security breach.
Bitget Hacker-Linked Wallets Move $78.61 Million in Bitcoin
Wallets associated with the September 2026 Bitget security breach transferred 1,052.34 BTC, valued at approximately $78.61 million, between November 6 and 11, according to a new investigation published by blockchain intelligence firm Arkham.
Of that amount, 847.26 BTC, worth approximately $63.43 million, entered 66 CoinJoin transactions. The figure represents about 80.5% of the Bitcoin moved during the six-day period.
Arkham identified the earliest CoinJoin activity at 09:27 UTC on November 6. Some 579.80 BTC, valued at $43.59 million, moved directly from wallets labeled as belonging to the Bitget attacker into CoinJoin transactions.
The remaining 267.46 BTC, worth approximately $19.84 million, reached CoinJoin through intermediary addresses, passing through between one and six additional transfers.
Daily outflows increased toward the end of the observation period. Arkham recorded 137.71 BTC leaving the tracked wallets on November 6, followed by 156.04 BTC on November 7 and 16.75 BTC on November 8.
Movements accelerated to 206.31 BTC on November 9, 238.79 BTC on November 10 and 296.74 BTC on November 11, with the final day’s data covering activity only through 11:58 UTC.
The November 11 transfers alone were valued at approximately $21.83 million, making that the largest daily movement in the six-day dataset.
It was six days of movement, not a second $78.61 million breach.
Arkham’s latest snapshot showed another 959.29 BTC, worth approximately $71.44 million, remaining in wallets it associates with the attacker. Including smaller cryptocurrency balances, the tracked wallets held approximately $71.86 million.
The remaining figure covers only assets still present in Arkham’s labeled addresses. It does not represent the total amount of stolen cryptocurrency still outstanding across every blockchain or destination.
The original Bitget attack occurred on September 24, when unauthorized withdrawals affected the exchange’s hot and warm wallet infrastructure. Bitget subsequently revised its estimated losses from $351.6 million to $387.5 million after identifying additional affected assets.
The new report extends an investigation previously examined by DaveFinances in its coverage of the Bitget hacker’s $19.48 million in October transfers. That earlier analysis identified 52 transactions between October 21 and 24, with most funds sent to newly used addresses rather than identified cash-out destinations.
The latest activity provides more specific information about where a substantial proportion of the Bitcoin went next.
CoinJoin Transactions Complicate the Bitget Recovery Trail
The movement into CoinJoin marks a substantial expansion of privacy-enhancing transactions involving funds that Arkham attributes to the Bitget attacker.
CoinJoin combines Bitcoin inputs from multiple participants into a single transaction containing multiple outputs, weakening the direct relationship between the sending and receiving addresses.
The Financial Action Task Force’s report on ransomware financing identifies CoinJoin and similar mixing arrangements as techniques that can complicate the tracing of illicit cryptocurrency. The technology also has legitimate privacy applications, and its use alone does not establish criminal activity.
Arkham’s investigation distinguishes the 847.26 BTC entering CoinJoin from another 205.08 BTC that moved through different routes.
Of that second amount, 172.33 BTC, worth approximately $12.72 million, remained unspent across 250 addresses at the time of its analysis. Another 16.38 BTC was still moving through intermediary wallets.
Arkham also identified approximately 10 BTC sent toward Maya Protocol, 4.37 BTC distributed across hundreds of small outputs and another 2 BTC associated with THORChain and exchange-related destinations.
The transfers therefore did not follow one continous route. Some reached CoinJoin directly, others passed through fresh addresses, while a smaller portion remained outside the identified mixing transactions.
Earlier investigations had already identified comparable behavior on a much smaller scale. In September, blockchain compliance firm AMLBot traced approximately 4 BTC associated with the Bitget breach into Wasabi CoinJoin following conversions involving Tron, Ethereum and THORChain.
DaveFinances previously detailed that four-network route into Wasabi CoinJoin, including how intermediary conversions reduced the opportunities for centralized services to identify or restrict the assets.
The old trail was smaller, much smaller.
Arkham’s newly reported 847.26 BTC represents more than 200 times the approximately 4 BTC identified in that September example, although the reports concern different observation periods and attribution methods.
CoinJoin transactions remain publicly visible on Bitcoin’s blockchain. Their privacy characteristics can make it harder to associate particular outputs with specific inputs, but they do not erase transaction records or establish that funds have reached a cash-out destination.
Arkham’s identification of the wallets as belonging to the Bitget attacker is based on its tracing and address-labeling methodology. The blockchain records do not independently prove the beneficial ownership of every wallet involved.
The wallet label is an attribution, not an identity.
TLBL Theft-Linked Wallet Converts $3.4 Million in DAI Into Ether
A wallet associated with a separate cryptocurrency theft involving an investor known as TLBL converted approximately 3.4 million DAI into 1,650 ETH on November 11, according to blockchain analytics account Lookonchain.
Lookonchain reported the activity at approximately 01:43 UTC, saying the purchases had occurred over the preceding hour.
The transaction value implies an average conversion price of approximately $2,061 per ETH, before accounting for execution costs or differences between individual swap prices.
The wallet identified in the investigation is 0xfE111e2377Ba149c3164B81448aE7457e5a55301.
Lookonchain links the address to a theft reported in August 2026, when wallets associated with TLBL reportedly lost more than $26 million following an apparent private-key compromise.
At the time, blockchain security researchers identified losses involving multiple assets, including wrapped Bitcoin, DAI, Ether and interest-bearing tokens.
Lookonchain also reported that the same investor had suffered an earlier phishing-related theft involving 9,579 stETH and 4,851 rETH, valued at approximately $24.05 million at the time.
The November activity concerns a conversion of assets associated with the previous incident. It is not evidence that the investor suffered another $3.4 million theft.
The reported transaction changed the composition of the wallet’s holdings from a dollar-denominated stablecoin into ETH, exposing that portion of the funds to Ether’s subsequent price fluctuations.
The DAI changed hands for ETH, and that is where the confirmed description stops.
No public evidence reviewed for the latest movement establishes that the ETH was deposited at a centralized exchange, sold for fiat currency or transferred to an identified external beneficiary.
The association between the wallet and the earlier TLBL theft also depends on Lookonchain’s attribution. The available information does not independantly establish who controlled the wallet at the time of the swaps.
Dormant Bitcoin Whale Deposits $73.78 Million Into Binance
Separately, Lookonchain reported on November 12 that a Bitcoin wallet described as inactive for approximately four years transferred 1,000 BTC, worth about $73.78 million, to Binance.
The blockchain analytics account published its alert at approximately 02:37 UTC and described the transaction as having occurred around eight hours earlier, placing the movement on the evening of November 11.
Lookonchain identified the sending address as bc1qwd9jr0gkyh33g99u95mnr7326am0wfw95evhzs.
Four years quiet, then 1,000 BTC went to an exchange.
The transaction differs from large transfers between unidentified personal wallets because Lookonchain identifies the destination as Binance, placing the Bitcoin within infrastructure capable of facilitating spot trades, derivatives collateral arrangements and custody services.
Nevertheless, an exchange deposit does not establish that the owner sold the cryptocurrency.
The holder’s identity remains unknown, and the publicly reported transaction does not reveal whether the Bitcoin was deposited for trading, collateral, safekeeping or another purpose.
The case follows another substantial dormant-wallet movement covered by DaveFinances in September, when a four-year-dormant Bitcoin wallet transferred 4,500 BTC worth approximately $381 million.
That earlier transaction sent Bitcoin to a newly created address without a confirmed exchange connection. The November transfer is different because its reported destination is an established trading platform.
The latest 1,000 BTC movement could increase the amount of Bitcoin available for trading on Binance, assuming Lookonchain’s destination attribution is correct. Determining whether it actually contributed to selling would require evidence of subsequent execution or additional information about the account receiving the deposit.
Across the three developments, the confirmed observations have different implications. Arkham has identified extensive CoinJoin activity involving Bitcoin attributed to the Bitget attacker, Lookonchain has documented an asset conversion linked to a previous theft, and a dormant wallet has reportedly sent a large Bitcoin balance to an exchange.
None of those observations, taken alone, establishes completed laundering, a fresh exploit or a confirmed Bitcoin sale. The seperation between visible blockchain movements and the identities or intentions behind them remains central to interpreting all three reports.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.