Millions in Stolen Bitcoin Shifted to Unidentified Wallets

Blockchain intelligence data reveals that digital assets tied to a significant September security breach are on the move, with $19.48 million shifted across 52 separate transfers in late October.

According to tracing by Arkham, the transfers occurred between 10:02 UTC on October 21 and 02:48 UTC on October 24. The overwhelming majority of the relocated funds consisted of Bitcoin, accounting for $19.33 million of the total volume. Ether comprised the smaller remaining balance of the transfers. Analysts noted that nearly all of these funds were directed into entirely new addresses.

While researchers questioned whether the exploiter is actively laundering the stolen digital assets, tracking operations have not yet identified any centralized exchange, cryptocurrency mixer, or over-the-counter desk receiving this latest batch of outflows.

The late October activity is part of a larger, ongoing migration of the stolen funds. Tracking data indicates that the attacker has dispatched a total of $78.01 million to new addresses since October 15. The daily breakdown of these movements reveals substantial shifts, including $23.31 million on October 15, $10.51 million on October 18, $15.13 million on October 20, and an additional $7.3 million on October 23.

Remaining Balances and Exploit Scale

Despite the recent outflows, the hacker still commands a massive reserve of stolen cryptocurrency. The remaining labeled holdings are currently valued at $242.54 million. This ongoing balance is heavily concentrated in Bitcoin, with the exploiter holding 2,960.01 BTC worth approximately $241.99 million. The rest of the lingering funds are distributed in smaller balances across the Ethereum, Hypercore, Solana, and Tron networks.

Arkham described the current remaining stash as representing 69% of what it calculated to be a $350 million theft. However, Bitget’s own revised estimates place the total scale of the incident slightly higher, at about $387.5 million.

The exploiter has utilized various tools to obfuscate the origin of the assets. Earlier investigations conducted by AMLBot and Bitquery showed that in September, the stolen funds were routed through privacy protocols and routing systems such as CoinJoin, THORChain, Chainflip, USDT0, and various cross-chain swaps.

Vulnerability Details and Q3 Losses

Bitget executives have stated that the original breach was the result of a vulnerability found within a third-party security product, which enabled the attackers to execute forged withdrawal commands. The exchange confirmed that individual customer balances remained unaffected by the incident, and standard withdrawal functions were completely restored by October 2.

Following the exploit, CEO Gracy Chen noted that the exchange's Protection Fund had been restored to above $300 million. To encourage the return of the missing assets, the trading platform has offered a 5% recovery reward for any eligible actions that successfully freeze or recover the stolen funds.

The broader landscape for digital asset security remains strained. Security firm Hacken reported that third-quarter cryptocurrency hack losses accumulated to $1.18 billion across 107 incidents, marking a 55% surge from the second quarter. At the time the wallet movements were reported, Bitcoin was trading near $80,666.