Bitget Hack Wallets Move $19.48 Million in Bitcoin Across 52 Transfers

On October 24, 2026, Arkham Intelligence disclosed that addresses connected to the Bitget hack executed 52 transfers totaling $19.48 million, with $19.33 million in Bitcoin and the rest in Ethereum. The activity occurred between 10:02 UTC on October 21 and 02:48 UTC on October 24, sending nearly all funds to previously unseen addresses.

The report marks the latest phase of fund movements tracked since the September incident. Arkham noted the transfers as potential signs of laundering attempts, though recipient addresses remain unidentified in public data.

Bitget Hack Fund Movements Tracked by Arkham Intelligence

Since October 15, Arkham has recorded $78.01 million moved from the labeled hacker wallets to new addresses. Daily volumes peaked at $23.31 million on October 15 and dropped to zero on October 19 before resuming at lower levels through October 23. The most recent batch adds to this cumulative figure.

Remaining holdings under Arkham labels stand at approximately $242.54 million, including 2,960.01 BTC valued near $241.99 million. This amount represents about 69 percent of the $350 million baseline the firm used for its initial tracking after the breach.

Arkham has not identified any mixing services or conversion points in the latest transfers. Public blockchain data shows the funds split across multiple new wallets without immediate consolidation or exchange deposits.

September Incident Details and Bitget Response

The underlying breach occurred on September 24, 2026, when attackers drained between $387.5 million and $388 million from Bitget hot and warm wallets across Ethereum, XRP Ledger, and additional chains. Cold storage and private keys stayed untouched. The exploit relied on forged internal withdrawal instructions that bypassed a third-party security product.

Bitget detected anomalies at 18:31 UTC, halted withdrawals, and limited further losses. The company fully reimbursed users through its User Protection Fund, which exceeded $464 million before the event. Company capital restored the fund, and withdrawals reopened in stages: Bitcoin on September 28, Ethereum on September 29, USDT on September 30, and remaining assets by October 2.

Bitget stated it continues to cooperate with law enforcement agencies. No recovery announcements tied specifically to the October 21–24 transfers had been issued as of the reporting date. Earlier attribution discussions pointed to possible North Korean actors, but official confirmation remains absent.

Current Status of Remaining Hacker Holdings

Public tracking shows the bulk of the original stolen assets still held in addresses Arkham continues to monitor. The $242.54 million in labeled holdings includes the large Bitcoin position and smaller amounts across other chains.

Analysts note that the pattern of splitting funds into new wallets without immediate exchange activity aligns with early-stage laundering tactics observed in prior incidents. Further movement or conversion steps have not appeared in available data through October 24.

Market observers will watch for any deposits into known services or additional large transfers that could signal the next phase of fund redistribution.