Bitget Hacker Pushes 80% of $78.6 Million in Bitcoin Through CoinJoin as Exchange Breaches Point to Withdrawal Systems

The attacker behind the nearly $388 million theft from Bitget moved $78.61 million in bitcoin out of tracked wallets between November 6 and November 11, according to blockchain analytics firm Arkham. About 847 BTC of that, or roughly 80.5%, went into CoinJoin transactions, which mix many users' coins together to break the link between sender and receiver. The largest single outflow, worth about $21.83 million, came on November 11. Bitget chief executive Gracy Chen told CNBC the exchange had frozen only about $1.1 million of the stolen funds. Security firm Mandiant found that the attackers gained privileged system access and bypassed withdrawal controls without ever extracting private keys. Bitget says it is covering the loss from its own capital.

Brazil's Mercado Bitcoin, tracked by Rekt News, shows the same pattern. The exchange put its November 2 loss at about $38 million, while on-chain analytics firm Bitquery counted $48.5 million taken across 10 chains. Investigators found plain transfers following a suspected compromise of the system that approves legitimate transactions. They found no smart-contract flaw. Bitquery data shows the attacker kept draining deposit addresses for about four hours after the exchange said it had contained the breach. Tether, Circle and Chainalysis helped freeze more than $15 million, and Mercado Bitcoin pledged to cover user losses. No group has been attributed.

Both incidents follow the $6.3 billion Binance theft, which the FBI attributes to TraderTraitor, the North Korea-linked group it also blamed for the 2025 Bybit theft. TRM Labs reports that the attackers obtained signatures in advance and executed them in one burst. Binance says about $3 billion is frozen. North Korea denied involvement in a statement that Kim Yo Jong, sister of leader Kim Jong Un, issued on November 3.

On the protocol side, Initia halted its network after an attacker used a compromised Google Cloud Platform key on November 9 to reach Anvil, its rollup-hosting platform, and move $3.27 million. About $2.16 million remains frozen on the halted chain. It was Initia's second loss in three weeks. On October 23, a flaw in its MoveVM script cache let an attacker mint roughly $2.7 million in unbacked tokens and bridge them out.