What happens when more than a thousand Bitcoin suddenly start leaving the wallets tied to one of the larger exchange breaches of the year? You get a stretch of six days that forces everyone watching the chain to pay closer attention. Between the sixth and the eleventh of November the labeled addresses associated with the Bitget incident released 1,052.34 BTC, a sum that at the time sat near $78.61 million. Roughly four-fifths of that total flowed into CoinJoin transactions. The pattern feels deliberate, methodical, and more than a little frustrating for anyone hoping for a quick freeze.
How The Six-Day Bitcoin Outflow Unfolded
I keep coming back to the daily numbers because they tell a clearer story than any single headline. On the first day of the window the outflow sat at 137.71 BTC. The next day it edged higher to 156.04 BTC. Then came a sharp slowdown: only 16.75 BTC left on the eighth. After that the pace picked up again. Two hundred six BTC on the ninth, almost 239 on the tenth, and a peak of 296.74 BTC by midday on the eleventh. The average across those six days landed near 175 BTC, or roughly $13 million each day.
That acceleration matters. Early movements looked measured. Later ones looked more urgent. Whether the operator simply grew more confident or needed to move larger amounts before some external pressure arrived is hard to say from the outside. What is clear is that the largest single-day total arrived right at the end of the tracked period.
CoinJoin Takes The Lion’s Share
Of the total Bitcoin that left the labeled set, 847.26 BTC entered CoinJoin transactions. That works out to about 80.5 percent of everything moved. Some of those coins went straight from the known wallets into the mixing process. Others traveled through one to six intermediate addresses first. The direct path accounted for roughly 580 BTC. The multi-hop route carried another 267 BTC.
CoinJoin itself is nothing new. It combines inputs from multiple participants so that the link between any single input and any single output becomes harder to prove. In practice it creates a thicker fog around the money. Earlier, smaller amounts from the same incident had already been linked to similar activity after crossing chains. Seeing the technique used at this scale feels like a natural next step for someone trying to break the trail.
I’ve watched enough of these trails over the years to know that perfect anonymity is rare. Still, every extra hop and every mixed output raises the cost and the time required for anyone trying to follow the funds. That cost is exactly the point.
What Stayed Outside The Mixer
Not everything went into CoinJoin. Another 205 BTC left the labeled wallets but never entered a mixing transaction during the window. Of that slice, about 172 BTC sat unspent across 250 different addresses at the latest snapshot. A smaller portion continued moving through additional hops. Ten BTC went toward a cross-chain protocol. A few more sat in hundreds of tiny outputs.
Those unmixed coins are the ones that still look relatively straightforward to watch. They also form the part of the remaining balance that could, in theory, become subject to freeze requests if the right cooperation materializes. The mixed portion is a different story.
The Balance That Remains
After the six days of activity the labeled wallets still held 959.29 BTC, valued near $71.44 million at the time of the update. Bitcoin made up more than 99 percent of the tracked portfolio. The rest consisted of residual stablecoins and a modest amount of ether. A small fraction of the total was flagged as frozen. The bulk remained liquid.
Compare that figure with the holdings reported in late October and the difference jumps out. Earlier snapshots showed a much larger Bitcoin balance. The recent outflows have clearly reduced the size of the remaining pile, even if hundreds of millions in value still sit under the same labels.
The Original Breach And Its Aftermath
The whole episode traces back to a September incident. Initial public estimates put the transferred assets near $350 million. Later revisions pushed the figure higher after additional assets were identified. The exchange stated that the increase reflected previously omitted holdings rather than fresh unauthorized withdrawals. Investigation partners were brought in and the underlying vulnerability was reported as fixed.
What followed was a familiar pattern in large thefts. Funds sit for a while. Then they begin to move in stages. Some periods show quiet. Others show sudden volume. The six days in early November fit that second category.
Recovery Incentives On The Table
The exchange has kept a recovery program active. Participants who help freeze funds can receive a percentage of the amount frozen. A separate percentage applies to amounts that are actually recovered. Eligibility and payment decisions rest with the company. Actions taken under formal legal processes sit outside the incentive structure.
Whether those incentives will pull meaningful amounts back remains an open question. History with similar programs is mixed. Some produce results. Others produce little more than noise. The fact that a large share of the recent movement went through CoinJoin does not make recovery easier.
Why Daily Volume Matters More Than Total Size
Looking only at the $78 million figure can make the movement feel abstract. Breaking it into daily slices changes the picture. Early days stayed under 160 BTC. The final day approached 300. That climb suggests either growing operational confidence or a decision to clear larger amounts before conditions changed.
In my experience the shape of the outflow often reveals more than the absolute number. Steady small transfers can signal testing. Sudden larger transfers can signal a shift in priorities. Here the data leaned toward the second pattern after a brief quiet period in the middle of the window.
The Practical Limits Of On-Chain Visibility
Blockchain analysis can follow coins from labeled addresses into mixers and out again. What it cannot always do is prove ownership of the outputs that leave the mixer. That gap is the entire purpose of the technique. Once the coins emerge on the other side, the trail becomes probabilistic rather than deterministic for most observers.
Some clusters will still look suspicious because of timing, size, or subsequent behavior. Others will blend into ordinary traffic. The net effect is delay and uncertainty. For an operator trying to create distance from the original labels, that uncertainty is useful.
Smaller Earlier Movements Set The Stage
Before the November window, smaller transfers had already been recorded. One earlier cluster moved just under $20 million across dozens of transactions. Almost all of those coins went to fresh addresses rather than known exchanges or mixers at the time. The November activity looks like a continuation and escalation of that earlier pattern.
Seeing the same wallets reduce their holdings in stages is consistent with careful operational security. Moving everything at once creates a larger, more obvious event. Spreading the activity reduces the chance that any single day triggers an immediate response that freezes the remainder.
What The Residual Portfolio Looks Like
Beyond the Bitcoin, the remaining holdings include stablecoin balances and a smaller ether position. The stablecoin portion is modest relative to the overall value. Most of the economic weight still sits in the BTC that has not yet left the labeled set.
That concentration creates both risk and opportunity for anyone monitoring the addresses. Large remaining Bitcoin balances can be watched in real time. They can also be moved quickly once a decision is made. The recent acceleration shows how fast the picture can change.
The Human Side Of Watching These Trails
There is a strange rhythm to following large thefts. Days pass with almost no movement. Then a cluster of transactions appears and the charts light up. Analysts update their notes. Social feeds fill with screenshots. Then quiet returns. The November stretch broke that quiet for nearly a week.
I find myself wondering how the people on the other side of those wallets view the same data. Do they watch the public commentary? Do they adjust timing based on external attention? Or do they simply follow a pre-planned schedule regardless of the noise? The on-chain record alone cannot answer those questions.
Mixing Efficiency And Its Trade-Offs
CoinJoin works best when many participants contribute inputs of similar size at the same time. Large amounts from a single source can stand out even inside a mixed transaction if the volume is unusual. That tension sits at the heart of the recent activity. Moving hundreds of Bitcoin through the protocol improves privacy relative to a direct transfer, yet the scale itself creates a signal.
Whether the operator considered that trade-off is unknown. The choice to route most of the outflow through the technique still shows a clear preference for reducing direct linkage over keeping the process simple.
Unspent Outputs And Future Options
The 172 BTC sitting across 250 addresses form a set of dormant targets. They can remain quiet for months. They can also move at any moment. Their current distribution suggests an attempt to avoid concentrating the entire residual balance in a handful of easy-to-watch places.
From an investigator’s perspective those addresses remain high priority. From the operator’s perspective they represent optionality. Both sides understand the same map. They simply prefer different outcomes.
Cross-Chain Paths Already Tested
Earlier tracing work had already shown funds leaving Bitcoin, moving through other networks, and sometimes returning. Those paths add complexity. They also introduce new points of potential failure or detection. The decision to keep the bulk of the November movement inside Bitcoin CoinJoin rather than immediately bridging suggests a preference for one privacy tool over another at this stage.
That preference can change. Once coins leave a mixer they can still be bridged, swapped, or parked in new wallets. The current snapshot only captures one phase of a longer process.
How Freezes Actually Happen
Freezing stolen crypto is rarely as simple as a single court order. It usually requires cooperation from exchanges, custodians, or service providers that hold the funds at a given moment. When coins sit in self-custody or inside privacy protocols the practical options shrink. The recovery program acknowledges that reality by separating freeze incentives from recovery incentives.
Even successful freezes do not always lead to return of the assets. Legal processes take time. Jurisdictional questions arise. The percentage offered to helpers reflects the difficulty of the overall task.
The Broader Pattern In Large Exchange Incidents
This is not the first time stolen exchange funds have moved through mixers in stages. The same sequence appears after many high-value events. Initial dormancy. Gradual testing of movement methods. Then larger transfers once the operator gains confidence. The Bitget-related activity fits the template closely enough that the November numbers feel familiar rather than surprising.
What varies is the speed and the specific tools chosen. Some operators favor bridges. Others favor mixers. Some keep everything on one chain. Others hop repeatedly. The current case has leaned heavily on CoinJoin inside Bitcoin itself.
Watching The Remaining Balance In Real Time
The 959 BTC still inside the labeled set can be monitored continuously. Any sudden transfer will appear quickly on public explorers and analytics platforms. That visibility works both ways. It allows rapid public updates. It also lets the operator know that large remaining balances are under observation.
Whether that shared knowledge changes behavior is another open question. Some operators ignore the attention. Others appear to adjust timing or destination in response. The data alone rarely settles the debate.
The Role Of Intermediate Addresses
Roughly a third of the Bitcoin that entered CoinJoin first passed through fresh addresses. Those intermediate stops add a layer of separation. They also create additional data points that can be clustered if the same pattern repeats. The use of one-to-six hops before mixing suggests a deliberate effort to avoid sending labeled coins directly into the protocol in every case.
Small operational details like that often matter more than the headline totals. They reveal how carefully the movement is being managed.
Stablecoin And Ether Residuals
The non-Bitcoin portion of the remaining portfolio is small but not zero. Stablecoin balances and a limited ether holding sit alongside the main BTC position. Those assets can move independently. They can also be converted. Their presence keeps a secondary set of addresses worth watching even after the bulk of the Bitcoin has been processed.
In practice the economic importance of those residual holdings is minor compared with the Bitcoin. Their existence still expands the surface that needs monitoring.
Why The Percentage Through CoinJoin Stands Out
Eighty percent is a high share. It shows a clear operational preference rather than occasional use of the tool. When the majority of an outflow chooses the same privacy method, the pattern itself becomes a signal. Future movements that follow the same route will be easier to anticipate even if individual outputs remain hard to link.
That predictability is a double-edged sword. It helps analysts allocate attention. It also tells the operator that the preferred method is now well known.
The Quiet Day In The Middle
The sharp drop to under 17 BTC on the eighth of November is easy to overlook. Yet it may be one of the more interesting data points. Was it a deliberate pause? A technical issue? A response to external events? The chain does not say. The surrounding days show higher volume both before and after, so the quiet stands out by contrast.
Pauses like that sometimes precede larger moves. Sometimes they simply reflect operational constraints. Either way they belong in any careful reconstruction of the timeline.
Looking Ahead From The Current Snapshot
The six-day window is closed. The coins that entered CoinJoin have begun their next phase of existence. The coins that remain labeled can still leave at any time. The recovery incentives stay in place. The investigation partners continue their work. None of those facts guarantees a particular outcome.
What can be said with confidence is that the recent activity reduced the size of the remaining Bitcoin balance while increasing the share of funds that have passed through a privacy protocol. That combination shapes the practical options available to everyone involved.
I expect further movement. The only real questions are timing, destination, and whether any meaningful portion can still be frozen before it disappears deeper into the graph. The next update will likely arrive the same way the last one did: a cluster of transactions, a set of new screenshots, and another round of public discussion about how much of the original total remains within reach.
Until then the labeled wallets sit quieter than they did during those six days, but the underlying story is far from finished. Large thefts rarely end with a single clean chapter. They tend to stretch across months of intermittent activity, partial recoveries, and long stretches of silence. This one is following that familiar arc.
The numbers from early November simply mark one more visible chapter in a longer process that began in September and shows no sign of concluding soon. Anyone watching the addresses will keep watching. The operator on the other side will keep deciding when and how to move the next slice. The gap between those two perspectives is where the real tension sits.
And that tension is unlikely to resolve quickly. CoinJoin has already done its job for a large share of the recent outflow. The remaining balance is still large enough to matter. The recovery program is still open. The next meaningful transfer could arrive tomorrow or months from now. The only certainty is that the trail remains active even when the daily totals drop back toward zero.
