According to Arkham data, there were a total of 52 transactions involving funds associated with Bitget hackers from October 21 to October 24, 2026, with a cumulative transfer of $19.48 million to new addresses. Almost all of this value was transferred in the form of Bitcoin, and this blockchain intelligence company estimates that the attackers' remaining holdings are valued at $242.54 million.

Key Points

• Since October 15th, the total amount of funds transferred related to Bitget hackers has reached 78.01 million US dollars.
• The precise timestamp covers a period of 64 hours and 46 minutes, which provides a more specific time frame for analysis than the “past 48 hours” mentioned in a later post.

From October 15th to October 23rd, Arkham recorded a total of 78.01 million US dollars in funds transferred to the new address. The daily figures are as follows: 23.31 million US dollars on October 15th, 8.68 million US dollars on October 16th, 1.15 million US dollars on October 17th, and 10.51 million US dollars on October 18th.

Arkham shows no capital movements on October 19th, followed by $15.13 million on October 20th, $11.74 million on October 21st, $184,160 on October 22nd, and $7.3 million on October 23rd.

Different benchmarks were used for estimating the remaining positions and the amount of funds stolen.

According to the snapshot of Arkham, the total valuation of the remaining labeled assets is 242.54 million US dollars, of which 2,960.01 BTC are valued at 241.99 million US dollars, accounting for a portion of it. The smaller balances are distributed across Ethereum, Hypercore, Solana, and Tron.

The company stated that these holdings represent 69% of the estimated $350 million in losses. Bitget uses a different benchmark: approximately $387.5 million, which is an upward adjustment from its initial estimate of $351.6 million.

In the recovery announcement on September 25th, Bitget stated that the reason for the increase was the inclusion of Zcash and TRON assets, which were overlooked in the initial calculations, into the statistics. The exchange mentioned that this adjustment reflects a more comprehensive classification of the original transfers, rather than an additional occurrence of theft.

Based on the estimates revised with Bitget, the position snapshot of Arkham accounts for approximately 62.6%. These comparisons measure the relationship between the remaining labeled assets and the original loss estimates, and do not equate to the total amount recovered.

The tracking in September involved CoinJoin and cross-chain paths.

Earlier investigations traced the stolen assets that were transferred through CoinJoin and multiple cross-chain services. In September, AMLBot traced approximately 4 BTC coins that entered CoinJoin via Wasabi, describing this as an attempt to conceal the flow of funds.

AMLBot also traced a path from TRON to USDT, then via USDT0 to Ethereum, and subsequently through ETH it was exchanged and transferred into Bitcoin via THORChain. Approximately 4.59 BTC were transferred out of this path, after which they were split into smaller amounts.

Bitquery also separately records the conversions from THORChain to Chainflip during September. As of 14:38 on September 25th, UTC, its investigation has matched 66 exchanges, corresponding to 126.71 payments of BTC. There are also two additional exchanges that were still pending completion at that time point.

Bitget Restore withdrawals and advance the recovery of assets

Bitget completed phased restoration of withdrawals on October 2nd, and after re-opening the services of BTC, ETH, and USDT in September, full restoration was achieved. An event update on October 20th stated that customer account balances were not affected, and it was indicated that no further unauthorized transfers were found after the incident was brought under control.

The exchange attributed this vulnerability to a defect in a third-party security product. Bitget indicates that attackers obtained advanced internal credentials and issued false withdrawal instructions that bypassed risk control. Bitget states that the affected systems have been isolated and the vulnerability has been fixed.

CEO Gracy Chen stated that the protection fund once again exceeded $300 million on September 30. Bitget said that the fund will absorb the financial losses caused by this vulnerability.

The recovery announcement on September 25 mentioned that Mandiant and SlowMist are investigation partners, and it was stated that coordination with industry partners has led to the freezing of certain assets. The announcement also disclosed the receiving addresses applicable to Ethereum-compatible networks, XRP Ledger, Zcash, and TRON.

For voluntary actions that meet the criteria and are able to successfully freeze or recover affected assets, Bitget offers a separate bonus of 5%. Actions taken under court orders, requests from law enforcement departments, or other legal procedures are not included in this scope. The exchange retains the discretion regarding eligibility and payments.

This article was assisted by artificial intelligence and has been reviewed by an editorial team.