Bitget hackers move $4 million into Zcash’s private pool, making funds harder to trace

Wallets linked to the Sept. 24 Bitget security breach directed about 2,746 zcash (ZEC) into Zcash’s Ironwood shielded pool on Wednesday, a move that hides transaction details from public view. Chain records reviewed by reporters show the funds arrived in three separate deposits between 08:15 and 08:46 UTC, totaling roughly $3.9 million and representing about 15% of the ZEC stolen in the hack. The deposits were routed through two intermediary addresses that were funded by a wallet Bitget identified as controlled by the attacker. Pseudonymous investigator ZachXBT flagged the movements and traced their origin to the attacker-linked wallet, which received nearly 18,917 ZEC during the initial breach. Zcash supports both transparent and shielded transactions. Transfers into Ironwood are visible as entries on-chain, but once inside the shielded pool the sender, recipient and individual transfer amounts are concealed. That means while investigators can observe the amounts that went into Ironwood and any amounts that later exit to public addresses, the protocol does not provide a direct transaction trail linking the two. Some other proceeds from the Bitget incident have been moved across blockchains through swap services. CoinDesk previously traced about $6.3 million in ether-to-bitcoin swaps via THORChain from one attacker-associated wallet, actions that left public records of the incoming ether and outgoing bitcoin. The Ironwood deposits, by contrast, increase complexity for tracing efforts and for Bitget’s ongoing recovery attempts.