# Bitget Hacker Pushes 80% of $78.6 Million in Bitcoin Through CoinJoin as Exchange Breaches Point to Withdrawal Systems

The Bitget, Mercado Bitcoin and Binance thefts all came from attackers who obtained the power to approve withdrawals, while Initia lost $3.27 million through a stolen cloud key.

- Published: 2026-11-12T05:46:45.461Z
- Canonical: https://polylog.news/crypto/2026-11-12/bitget-hacker-pushes-80-of-78-6-million-in-bitcoin-through-c
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/bitget-hacker-bitcoin-78-million-coinjoin/), [Rekt News (Mercado Bitcoin)](https://www.rekt.news/), [Quartz](https://qz.com/bitget-frozen-funds-crypto-hack-recovery-100226), [CoinDesk](https://www.coindesk.com/business/2026/11/05/mercado-bitcoin-hack-continued-hours-after-exchange-said-attack-was-contained-report-finds), [PBS NewsHour](https://www.pbs.org/newshour/world/fbi-says-north-korea-was-behind-6-3-billion-binance-heist-the-biggest-crypto-hack-in-history), [Cointelegraph](https://cointelegraph.com/news/initia-second-crypto-exploit-three-weeks)

The attacker behind the nearly $388 million theft from Bitget [moved $78.61 million in bitcoin out of tracked wallets between November 6 and November 11](https://crypto.news/bitget-hacker-bitcoin-78-million-coinjoin/), according to blockchain analytics firm Arkham. About 847 BTC of that, or roughly 80.5%, went into CoinJoin transactions, which mix many users' coins together to break the link between sender and receiver. The largest single outflow, worth about $21.83 million, came on November 11. Bitget chief executive Gracy Chen told CNBC the exchange had frozen [only about $1.1 million of the stolen funds](https://qz.com/bitget-frozen-funds-crypto-hack-recovery-100226). Security firm Mandiant found that the attackers gained privileged system access and bypassed withdrawal controls without ever extracting private keys. Bitget says it is covering the loss from its own capital.

Brazil's Mercado Bitcoin, [tracked by Rekt News](https://www.rekt.news/), shows the same pattern. The exchange put its November 2 loss at about $38 million, while on-chain analytics firm Bitquery counted $48.5 million taken across 10 chains. Investigators found plain transfers following a suspected compromise of the system that approves legitimate transactions. They found no smart-contract flaw. Bitquery data shows the attacker [kept draining deposit addresses for about four hours](https://www.coindesk.com/business/2026/11/05/mercado-bitcoin-hack-continued-hours-after-exchange-said-attack-was-contained-report-finds) after the exchange said it had contained the breach. Tether, Circle and Chainalysis helped freeze more than $15 million, and Mercado Bitcoin pledged to cover user losses. No group has been attributed.

Both incidents follow the [$6.3 billion Binance theft](https://www.pbs.org/newshour/world/fbi-says-north-korea-was-behind-6-3-billion-binance-heist-the-biggest-crypto-hack-in-history), which the FBI attributes to TraderTraitor, the North Korea-linked group it also blamed for the 2025 Bybit theft. TRM Labs reports that the attackers obtained signatures in advance and executed them in one burst. Binance says about $3 billion is frozen. North Korea denied involvement in a statement that Kim Yo Jong, sister of leader Kim Jong Un, issued on November 3.

On the protocol side, Initia halted its network after an attacker used a [compromised Google Cloud Platform key](https://cointelegraph.com/news/initia-second-crypto-exploit-three-weeks) on November 9 to reach Anvil, its rollup-hosting platform, and move $3.27 million. About $2.16 million remains frozen on the halted chain. It was Initia's second loss in three weeks. On October 23, a flaw in its MoveVM script cache let an attacker mint roughly $2.7 million in unbacked tokens and bridge them out.

## What this means

The common mechanism across these breaches is control of the withdrawal-approval path. None involved theft of cold keys or a flaw in contract code. Exchanges' operational software, signing services and cloud credentials are the attack surface, and proof-of-reserves attestations do not examine any of them. The cost lands on exchange balance sheets (Bitget's protection fund, Mercado Bitcoin's pledge) and on stablecoin issuers, whose ability to freeze tokens is now the main recovery tool. Freezes recover stablecoins. Bitcoin moved through CoinJoin cannot be frozen. After the 2025 Bybit theft, the same attacker group laundered most of the ether within weeks, and recoveries stayed a small fraction of the total. The desk expects the remaining Bitget bitcoin to finish moving through mixers within weeks, with recoveries staying close to the $1.1 million already frozen. That read holds unless exchanges flag the coins when they leave the mixers. A large seizure at an off-ramp would prove it wrong. Expect regulators in Brazil and Asia to start asking exchanges for audits of their back-office systems within months.

## What to watch

- Where the mixed Bitget bitcoin surfaces after CoinJoin. Deposits at a regulated exchange would give investigators a point where the coins can be frozen.
- Whether Brazil's central bank, which now licenses virtual-asset providers, sets operational-security requirements in response to the Mercado Bitcoin breach.
- Whether Initia publishes a full account of how its cloud key was compromised and restores the frozen assets, which will show whether its rollup-hosting model keeps privileged keys separate from the chain itself.