key insights
- The top spot in the outflow of $19.48 million went to Bitcoin at about 99.2% of the reported transactions.
- Arkham’s $242.54 million holdings estimate uses a different baseline from Bitget’s revised $387.5 million breach estimate.
- The October transfers remain unresolved because publicly available evidence does not establish their final destinations or prove laundering.
The Bitget hacker moved nineteen point four eight million dollars across 52 transfers, between October 21 and October 24 according to Arkham Intelligence. The Bitget hacker transferred nineteen point three three million dollars in Bitcoin. The destinations remain unknown leaving investigators without confirmed evidence of laundering or recovery.
Fresh outflows extend the october movement
Arkham was monitored from 10:02 UTC 21st Oct until 02:48 UTC 24th Oct. The transfers were made to new or unused wallet addresses, with almost all of the funds sent to new addresses. But Arkham didn’t have any receiving exchange, mixer or over-the-counter trading desk.
Is the Bitget Hacker laundering the stolen funds?
The Bitget Hacker moved $19.48M out of its wallets in 52 transfers between 10:02 UTC on 21 October and 02:48 UTC this morning. $19.33M of that was BTC, the rest ETH.
Here are the flows: pic.twitter.com/3AQtyJ6NlJ
— Arkham (@arkham) October 24, 2026
The blockchain intelligence firm wondered if the attacker was “laundering” the stolen assets. Still, it has published findings, which only show wallet movements, not confirmed sales, cash outs or laundering.
Arkham also said the transfers were activity in the last 48 hours. The times are around 64 hrs and 46 min, though. The exact times are thus the most reliable reporting period.
The majority of the reported outflow was in bitcoin alone, which was around 99.2%. The rest of the $150,000 is an implied Ether balance using the rounded numbers from Arkham.
October transfers reach $78 million
The latest transactions form part of a larger movement that began on October 15. Arkham reported $78.01 million in transfers from hacker-linked wallets to new addresses through October 23.
The daily figures show a pattern of activity. The attacker moved $23.31 million on October 15 followed by $8.68 million on October 16 and $1.15 million on October 17. Transfers reached $10.51 million on October 18. Arkham recorded no movement on October 19.
Activity accelerated again on October 20 when transfers reached $15.13 million. Arkham recorded another $11.74 million on October 21 followed by $184,160 on October 22 and $7.3 million on October 23.
Arkham valued the remaining labeled holdings at $242.54 million in its snapshot. Arkham’s assets included 2,960.01 BTC $241.99 million alongside smaller balances, across Ethereum, Hypercore, Solana and Tron.
However, the firm calculated that balance against a $350 million theft estimate. Bitget revised its own breach estimate from $351.6 million to approximately $387.5 million on September 25. The exchange attributed the difference to previously omitted Zcash and TRON assets.
Against Bitget’s updated estimate Arkham’s earlier balance made up 62.6% of the reported theft. Neither of these numbers shows the amount that has been recovered. That’s because both figures only count the remaining labeled assets. They don’t include confirmed reimbursements or funds that have actually been frozen.
Earlier tracing revealed cross-chain routes
Investigators had identified complex transaction routes before the latest October movements. In September, AMLBot traced Bitcoin into CoinJoin, a transaction-coordination technique that can obscure links between cryptocurrency transfers.
Its investigation followed funds from TRON into USDT, then across to Ethereum through USDT0. The route also involved THORChain and ETH swaps before approximately 4.59 BTC emerged. The Bitcoin subsequently moved in smaller amounts.
Bitquery separately documented conversions through THORChain and Chainflip. Its investigation matched 66 swaps to payments totaling 126.71 BTC by 14:38 UTC on September 25. Two swaps remained pending at that time.
However, these earlier findings do not establish where the October transfers went. Arkham’s latest posts provide no readable transaction-level evidence connecting those outflows to the previously identified services.
Exchange security and recovery remain under scrutiny
On October 20, Bitget’s incident expert explained that the incident had occurred due to a flaw within one of the third-party security products. The intruder gained access to the high-level internal credentials and sent fake withdrawal orders that were unable to be caught by existing risk controls, according to the exchange.
Bitget reported that it has isolated the impacted systems and patched the vulnerability. The company also added that customer account balances weren’t impacted and it found no additional unauthorized transfers following its containment efforts.
The exchange’s phased withdrawal restoration was completed on October 2. Meanwhile, the CEO Gracy Chen, said that Bitget’s Protection Fund surpassed $300 million on 30th September.
Bitget has also announced investigation partners, Mandiant and SlowMist. Its September recovery notice detailed coordination with industry partners that resulted in the freezing of some assets, but it had not been able to provide an overall figure of the assets frozen.
The exchange recovery program pays 5% separate rewards for qualifying voluntary transactions which are directly associated with the freezing or recovery of impacted assets. It is not voluntary, it is legal and/or law-enforcement.
The newest transfers are indicative of an ongoing struggle of the cryptocurrency exchanges. Blockchain monitoring could be used to establish transfers between wallets, but investigators must establish ownership, destinations, and purposes of the transfers before determining that the transfers were for laundering or recovery.
