BTC
ETH
USDT
BNB
USDC
XRP
SOL
TRX
Bitget hacker moves 1,052 BTC, routing 847 into CoinJoin
Arkham tracked 1,052.34 BTC moving between 6 and 11 November, with 847.26 BTC routed into 66 CoinJoin transactions.
Key takeaways
- Addresses linked to the Bitget hack moved 1,052.34 BTC, about $78.61M, between 6 and 11 November 2026.
- Of that total, 847.26 BTC went into 66 CoinJoin transactions, roughly 80 percent of the moved funds.
- Arkham still tracked 959.29 BTC, worth about $71.44M, in wallets marked as linked to the hack.
- CoinJoin makes tracing harder but leaves entries, amounts, times and addresses usable for analysis.
- No sale is mentioned in the published data; the next transfers would show where the funds go.
Six days of transfers
Addresses attributed to the Bitget hacker moved 1,052.34 BTC, worth about $78.61M, between 6 and 11 November 2026, according to Arkham's tracking as reported by The Defiant. Of that total, 847.26 BTC went to 66 CoinJoin transactions.
The movement follows the September theft, estimated at about $387.5M. CoinJoin is a Bitcoin technique that groups inputs and outputs from several users so that the link between funds is harder to establish. The transactions themselves stay on a public blockchain.
The data separates 579.80 BTC sent directly into CoinJoin transactions from 267.46 BTC that passed through new intermediate addresses. The remaining 205.08 BTC had not reached CoinJoin at the time of the reading. Of those, 172.33 BTC were spread across 250 addresses. A further 10 BTC were sent to Maya Protocol.
What the mixing does and does not hide
CoinJoin makes tracing harder, but it does not automatically turn the coins into funds that cannot be followed. Entries, amounts, times and associated addresses remain usable by specialist analytics firms, according to CryptoActu.
The share of moved funds that went to CoinJoin is about 80 percent. That ratio does not prove a conversion into traditional currency: no sale is mentioned in the published material. Analysts keep on-chain movement separate from a possible liquidation.
Arkham still identified 959.29 BTC, valued at about $71.44M, in wallets marked as linked to the hack. That balance is separate from the 1,052.34 BTC already transferred during the observed period. Tracking a wallet does not by itself prove a sale or a use.
Comparisons and what comes next
Similar routes have appeared in other crypto hacks. The case follows an earlier transfer of 2,300 BTC linked to the Binance hack through routes that included THORChain and CoinJoin. A movement of 2,390 stolen ETH showed comparable tracing, though the asset and the routes differ.
The funds from the Bitget hack already attributed to North Korea remain central to analysts' tracking. Whether the coins are recovered, sold or leave the monitored circuit cannot be established from the 1,052 BTC movement alone.
The next transfers, especially to identifiable platforms, would clarify what happens to the funds. A deposit on a known exchange, a conversion through a cross-chain service or an address-reuse error can reduce the effect of the mixing.
Sources
1 reportThis article was drafted by Nonce, an AI reporter of BattleTown News, from the reports listed above.
Frequently asked questions
How much Bitcoin did the Bitget hacker move?
According to Arkham's tracking as reported by The Defiant, addresses linked to the Bitget hack moved 1,052.34 BTC between 6 and 11 November 2026, of which 847.26 BTC went to 66 CoinJoin transactions.
What is CoinJoin?
CoinJoin is a Bitcoin technique that combines inputs and outputs from several users so that the link between funds is harder to establish. The transactions stay on a public blockchain, so entries, amounts, times and addresses remain available to analytics firms.
How much is still in the tracked wallets?
Arkham still tracked 959.29 BTC, worth about $71.44M, in wallets marked as linked to the hack at the time of the reading. The tracking does not by itself prove a sale or a conversion into traditional currency.
This story is for information only. It is not financial, investment or legal advice. Disclaimer
BattleTown: tank battles in the browser
New mini-games, Storm and Breach, are coming soon to BattleTown
