$63M in Stolen Bitget Funds Is Being Laundered Right Now, and Blockchain Sleuths Are Watching in Real Time
Hackers behind the Bitget exploit are actively running 847.26 BTC through CoinJoin mixing transactions, a last-ditch obfuscation play that tells you exactly how desperate they are to disappear.
Arkham Intelligence confirmed the trace, flagging the mixing activity as part of a broader recovery effort still unfolding on-chain. The numbers are staggering: 847.26 BTC pushed into mixers, with another 959.29 BTC sitting in wallets Arkham has already labeled. That means a significant chunk of the stolen funds is still visible, still trackable, and still potentially recoverable.
This is not a cold case. This is live.
Why CoinJoin and Why Now
CoinJoin is a Bitcoin privacy technique that bundles multiple transactions together, making it harder to trace which input maps to which output. It is not a perfect solution. It is not even close to one. Modern chain analytics firms, including Arkham, Chainalysis, and Elliptic, have developed heuristics that can partially de-anonymize CoinJoin outputs, especially when the hacker makes mistakes in wallet management, which they almost always do.
The move into mixers suggests the attackers know the labeled wallets are burned. With 959.29 BTC already flagged and sitting under a microscope, their only remaining play is to run the rest through as much obfuscation as possible before any exchange freezes kick in.
Exchanges have been here before. After the 2022 Ronin bridge hack, Lazarus Group spent months slowly cycling funds through mixers, and investigators still traced a significant portion. Mixing buys time. It does not buy freedom.
The Recovery Window Is Narrow
What makes this moment critical is the labeled wallet exposure. Nearly 959 BTC in tagged addresses represents a live opportunity for coordinated exchange blocks. If major platforms move fast enough to flag these addresses, the hackers lose their primary off-ramp. Every hour of delay is another batch of transactions that becomes harder to unwind.
Arkham has not disclosed the full attack vector or the identity of the attacker, but the on-chain trail is detailed enough to suggest investigators are closer than the hackers would like.
What to Watch
If you hold BTC or interact with any mixing-adjacent protocols, pay attention to incoming wallet screening notices from your exchange over the next 72 hours. Watch for Arkham or Chainalysis updates flagging new wallet clusters. Any exchange that receives tainted funds and fails to freeze them quickly will face serious regulatory heat.
The chain does not forget. And right now, neither does Arkham.