Bitget Hackers Move $4 Million Into Zcash’s Ironwood Privacy Pool

Wallets linked to Bitget’s roughly 387.5 million dollar hack moved about 2,746 ZEC, worth close to 4 million dollars, into Ironwood, Zcash’s newest shielded pool, in three transfers between 08:15 and 08:46 UTC, a move that substantially complicates tracing efforts on that portion of the stolen funds.

How the movement was discovered

Pseudonymous blockchain investigator ZachXBT first flagged the transfers, tracing the funds back through two intermediary addresses that were themselves funded by a wallet Bitget had already identified as belonging to the attacker. That attacker wallet received nearly 18,917 ZEC during the original September 24 breach, meaning the 2,746 ZEC moved into Ironwood represents roughly 15 percent of the total stolen Zcash holdings.

Why a shielded pool changes the tracing problem

Transfers inside Ironwood hide the sender, recipient, and transaction amount entirely, which is a fundamentally different privacy guarantee than the pseudonymous but fully traceable transaction history that applies to most other blockchains used in this specific hack. Investigators are not left completely in the dark, however; timing patterns and transaction values can still sometimes be used to correlate funds as they eventually resurface on public addresses outside the shielded pool.

Part of a broader laundering pattern

This Zcash movement is not the attacker’s only laundering method. CoinDesk has separately traced about 6.3 million dollars in ether-to-bitcoin swaps routed through THORChain from one attacker-linked wallet, showing the hackers are actively spreading the stolen funds across multiple distinct laundering channels rather than relying on any single method or protocol.

What this means for recovery efforts

Splitting stolen funds across a privacy-focused shielded pool, a cross-chain swap protocol, and presumably other channels still being traced makes any eventual full recovery of the Bitget hack proceeds considerably less likely than it would be if the attacker had kept funds concentrated in easily traceable addresses. Each additional laundering channel used adds both delay and genuine uncertainty to whatever fraction of the total theft investigators and exchanges are ultimately able to freeze or recover.

Frequently asked questions

Does using a shielded pool make funds completely untraceable forever? Not necessarily; funds eventually resurfacing on public addresses can sometimes still be correlated using timing and value patterns, even though the shielded transaction itself hides direct on-chain details.

Has any of the laundered Zcash been frozen? As of this reporting, the movement into Ironwood had been identified and publicly flagged, but there is no indication that shielded-pool funds specifically have been frozen, given the nature of shielded transactions.

This article is for informational purposes only and does not constitute financial advice. Details of ongoing security incidents and fund-tracing efforts can change as investigations continue.