Bitget Funds Enter Zcash Pool as $50M Swap Route Fails

A wallet linked by Bitget to the September 24 theft moved about $3.9 million in ZEC into Zcash's Ironwood shielded pool. The three deposits came just as wallets tied to the same attack were finding it much harder to route more than $50 million through NEAR Intents.

That contrast is the useful part. One protocol offered a private pool but could not reject the deposit. The other tried to block known illicit transactions before they settled, although roughly $166,000 still passed through.

$3.9 Million Crossed Into Ironwood

About 2,746 ZEC entered Ironwood in three transactions between 08:15 and 08:46 UTC on September 30. That represented roughly 15% of the ZEC stolen in the Bitget breach.

The ZEC first passed through two intermediary addresses funded by a wallet that Bitget had identified as attacker-controlled. Pseudonymous blockchain investigator ZachXBT flagged the movements that day.

Bitget identified the attacker wallet as having received nearly 18,917 ZEC during the attack. The later Ironwood deposit covered a smaller part of that amount.

What remains visible is the movement into the pool. Once inside Ironwood, the sender, recipient and amount are hidden. Zcash calls Ironwood its newest shielded pool, while deposits into it remain visible.

Privacy Cuts the Direct Trail

Zcash's protection sits in the protocol itself. NEAR Intents can reject a transaction through its risk system, but Zcash cannot single out the Bitget-linked deposit as it enters Ironwood.

There is still a way to investigate the funds later, but it is less tidy. If money leaves Ironwood for a public address, the withdrawal amount becomes visible. Analysts may compare timing, value and other metadata to connect deposits with exits.

What they do not get is a direct transaction trail between entry and withdrawal. The protocol does not provide that link.

Zcash has also been used legitimately. It recently recorded more than 62,000 shielded transactions in one week, its highest weekly count since 2022. The Ironwood transfer cannot be separated from that activity through the pool itself.

Ironwood was built after Zcash developers designed a new shielded pool in response to a critical issue involving the older Orchard system. The reporting reviewed for this story did not describe the cause or scope of that issue.

NEAR Intents Rejected Most of the Swaps

The wider attempt involved more than $50 million that wallets connected to the theft tried to process through NEAR Intents.

Its SHIELD risk system rejected most transactions before execution. Roughly $503,000 was frozen after swaps began, while about $166,000 passed through. The sources did not clarify whether that remaining amount was attacker-linked or legitimate activity.

A broker also rejected a separate attempt to route stolen assets through Chainflip before the transaction entered the protocol.

The choice reflects a disagreement about what permissionless access should mean. NEAR argued that open participation does not require liquidity providers to execute transactions they know are illicit. THORChain has taken the opposite position, saying selective censorship would undermine the principles governing its network.

THORChain Remains a Different Route

Bitget asked THORChain to block addresses linked to the theft, but THORChain resisted the request. About $6.3 million in ether-to-bitcoin swaps was traced through THORChain from one attacker-linked wallet.

Bitquery estimated that roughly 29,088 ETH, worth about $79 million at the time of its analysis, had entered THORChain and been swapped for Bitcoin through September 29.

THORChain also handled more than $1.5 billion in decentralized exchange volume during the days after the incident, compared with roughly $146 million in the week before the attack. The increase coincided with the hacker-linked flows, but it cannot all be attributed to them.

Bitget's Loss Estimate Rose to $387.5 Million

Bitget's final loss estimate for the September 24 attack was $387.5 million, up from an initial $351.6 million estimate. The exchange said the revision partly reflected the addition of Zcash and Tron assets during reconciliation.

The attack affected assets across Ethereum and other EVM networks, XRP Ledger, Zcash and Tron. Bitget said the attackers exploited a third-party security product and the exchange's transaction-signing infrastructure, rather than Bitget's private keys.

More than $700 million had moved out of tracked Bitget wallets by the time withdrawals began reopening, according to DeFiLlama data reviewed in the reporting. That figure represents movement from tracked wallets, not a confirmed total loss.

Bitget reopened Bitcoin withdrawals first, followed by Ethereum and USDT on several networks. It planned to reopen withdrawals for its other cryptocurrencies, fiat services and peer-to-peer services on Friday.

The exchange also reported a reserve ratio of 131% across 19 covered assets as of September 29. Its CEO, Gracy Chen, said the Protection Fund had been rebuilt to more than $300 million. Bitget has since launched a recovery bounty and published addresses linked to the attacker.

The visible trail now forks in two directions. Zcash makes part of the stolen ZEC harder to trace after it enters Ironwood. NEAR Intents demonstrates how a risk system can stop most of a known illicit route, provided the transaction reaches that system before execution.