According to Blockonomi, blockchain analytics firm Arkham has identified a significant pattern of obfuscation involving the hacker responsible for the recent Bitget exchange breach. Since November 6, the attacker has executed 66 separate CoinJoin transactions, a method designed to mix cryptocurrencies and obscure the trail of funds. This activity represents a concentrated effort to hide the movement of stolen digital assets following the initial compromise.
The data reveals that the hacker transferred a total of 847.26 Bitcoin into these CoinJoin protocols. At current market valuations, this volume is worth approximately $63.43 million. This specific amount constitutes roughly 80.5% of the total 1,052.34 BTC that exited the attacker’s associated wallets during a six-day window. The remaining portion of the funds has not yet been fully laundered or moved to external addresses.
Despite the extensive mixing efforts, a substantial portion of the stolen funds remains visible on the blockchain. Arkham reports that approximately 959.29 BTC, valued at $71.44 million, currently sits in wallets directly linked to the attacker. This indicates that while the hacker has attempted to disrupt the transaction history through CoinJoin services, the majority of the illicit capital has not been successfully dispersed or further anonymized.
These findings highlight the ongoing challenges faced by cryptocurrency exchanges and security firms in tracking large-scale hacks. While CoinJoin transactions can complicate forensic analysis, the persistence of identifiable wallet balances offers investigators a crucial foothold. The disparity between the mixed funds and the static holdings suggests that the attacker may be in the process of gradually laundering the remaining assets, making continuous monitoring essential for potential recovery efforts or legal action.
