Bitget Declared Containment. The Hacker Moved $78 Million in Bitcoin Anyway. What the Blockchain’s Receipt Actually Proves

(SeaPRwire) –

By: Lucas Caldwell

The Bitget hack isn’t a security story. It’s a confidence autopsy. Arkham just published exactly what happened after the September breach supposedly closed. The hacker moved $19.48 million across 52 transfers between October 21 and 24, almost entirely Bitcoin. Bitget announced phased withdrawal restoration finished on October 2. The hacker didn’t stop. Arkham asked publicly whether the hacker is laundering the stolen funds, and the destinations remain unidentified so far. The exchange’s containment narrative has a visible and growing crack in its foundation, and the blockchain doesn’t care about PR statements. This isn’t a story about a single breach. It’s a story about what happens when an entire industry treats containment as an endpoint rather than the start of a forensic cycle.

Arkham tracked the transfers between 10:02 UTC on October 21 and 02:48 UTC on October 24. Bitcoin made up $19.33 million of the total, with Ether covering the remainder. Nearly all funds went to new, unidentified addresses. Over a broader window, the attacker sent $78.01 million to new addresses since October 15. The single largest day was October 15, with $23.31 million moving. October 16 saw $8.68 million. October 17 saw $1.15 million. October 20 saw another $15.13 million. October 21 saw $11.74 million. October 23 saw $7.3 million move. No transfers moved on October 19, but the total kept climbing regardless. The daily totals never fully stopped, even after Bitget declared containment complete.

Arkham valued the hacker’s remaining labeled holdings at $242.54 million, including 2,960.01 BTC worth $241.99 million, with smaller balances sitting on Ethereum, Hypercore, Solana, and Tron. That equals 69% of a $350 million theft figure, or roughly 62.6% against Bitget’s higher $387.5 million estimate. AMLBot traced about four Bitcoin into CoinJoin back in September, describing the activity as an apparent effort to hide stolen funds. Bitquery documented 66 swaps matching 126.71 BTC in payments through THORChain and Chainflip by September 25. Those cross-chain routes are on the record. The newest transfers, however, went to addresses that remain entirely unidentified, and no exchange, mixer, or over-the-counter desk has been named as a receiver.

Bitget blamed the breach on a flaw in a third-party security product. The attacker obtained high-level internal credentials and sent forged withdrawal commands. CEO Gracy Chen said the Protection Fund returned above $300 million on September 30. The exchange offers a 5% recovery reward program for eligible actions that freeze or recover affected assets. Hacken reported $1.18 billion in crypto hack losses across 107 incidents in Q3, up 55% from Q2’s $763.9 million across 67 incidents. The industry is accelerating toward the same failure state faster than it can patch it. Third-party dependencies in exchange security are treated as infrastructure decisions, not risk exposures. That framing hasn’t changed, and the cost is now visible on the blockchain.

The real question isn’t whether the hacker is laundering. It’s whether anyone is. Bitget restored withdrawals and declared containment. Arkham found continuing outflows for weeks afterward. The 5% recovery bounty targets third parties who freeze assets, not internal security reform or vendor accountability. No exchange in this sector has publicly addressed the third-party dependency chain that allowed a single credential-based breach to unlock hundreds of millions. The supply chain for exchange security remains opaque. The current incentive structures point toward the next attack, not away from it. When an exchange can blame a vendor, the pressure to reform disappears entirely. That’s the structural vulnerability Arkham’s data just exposed, and it only gets worse as more exchanges outsource their security stack.

The Bitget hacker has moved $78 million in tracked transfers and still holds $242.54 million in labeled assets, Bitcoin traded near $80,666 at the time of reporting, the next $387 million breach isn’t a question of whether it gets traced on-chain but whether blockchain forensic teams can identify destinations before the next centralized exchange decides that a third-party security vendor is cheaper than proper infrastructure architecture — the current incentive math already favors the attacker, and nothing in this case changes that trajectory, because no exchange has made the vendor accountability problem its central operational concern.

Author bio: Lucas Caldwell, a tech opinion leader with millions of followers on X/Twitter, specializing in real-time crypto infrastructure analysis, on-chain threat intelligence, and exchange security forensics.