Bitget Hackers Move $3.9M in ZEC Into Zcash’s Shielded Pool

Wallets linked to the Bitget hack moved about $3.9 million in ZEC into Zcash’s private payment system on Wednesday, Sep. 30. The deposits make it harder for investigators to follow the stolen funds as Bitget tries to recover them.

A review of the transaction records found that 2,746 ZEC entered Ironwood, Zcash’s newest shielded pool, in three transfers between 08:15 and 08:46 UTC. That was about 15% of the ZEC stolen in the Sept. 24 breach.

The trail stops at Ironwood

The money passed through two intermediary addresses funded by a wallet that Bitget identified as belonging to the attacker. During the breach, that wallet received nearly 18,917 ZEC.

Zcash offers both public and private payments, so the handoff has two distinct stages. Investigators can see the amount enter Ironwood. Once the funds move inside the pool, the sender, recipient and amount are hidden.

It’s a small but consequential step. The public transaction still shows that the funds crossed into the shielded system, but it doesn’t reveal the next public address they reach, if they reach one at all.

Pseudonymous blockchain investigator ZachXBT first flagged the movements on Wednesday.

Public returns still offer clues

Moving into Ironwood doesn’t make the funds invisible forever. If they later leave the pool for a public address, the outgoing amount becomes visible again.

Investigators can compare the entry and exit points using timing, amounts and other metadata. What Zcash does not provide is a transaction trail directly linking the two. That leaves investigators with a narrower set of clues rather than a complete chain of payments.

This differs from an earlier route attributed to the same attacker. Earlier reports traced about $6.3 million in ether-to-bitcoin swaps through THORChain from an attacker-linked wallet. Those swaps left a public record of incoming ether and outgoing bitcoin.

Recovery faces a narrower trail

Bitget previously said the breach exposed $352 million in a hot wallet, while the later report describes the hack as $387.5 million. The difference in the figures isn’t explained in the source material, so it would be unsafe to treat them as directly comparable without more reporting.

The shift into Zcash doesn’t answer the more basic question of whether the funds can be recovered. It changes how much of the route investigators can see after the entry into Ironwood.

No statement from Zcash officials, law enforcement or Bitget’s recovery team about the shielded transfers was found.