Stolen Bitget Funds Worth $4M Enter Zcash Privacy Pool, Complicating Tracking

Wallets tied to the $387.5 million Bitget hack have moved roughly $3.9 million in zcash (ZEC) into Zcash’s shielded payment system, potentially making the stolen funds more difficult to trace.

CoinDesk’s review of blockchain transactions found that 2,746 ZEC was transferred to Ironwood, Zcash’s newest shielded pool, in three transactions between 08:15 and 08:46 UTC on Wednesday.

Pseudonymous blockchain investigator ZachXBT was the first to flag the transfers. The funds were routed through two intermediary addresses that had received funding from a wallet Bitget identified as belonging to the attacker. That wallet received nearly 18,917 ZEC during the Sept. 24 breach.

Zcash supports both transparent and shielded transactions. While investigators can see how much ZEC enters Ironwood, activity inside the shielded pool conceals the sender, recipient and transaction amount.

If the funds are later withdrawn to a transparent address, the amount leaving the pool becomes publicly visible. Investigators can examine timing, amounts and other metadata to look for possible connections between deposits and withdrawals. However, the Zcash protocol does not provide a direct transaction trail linking a specific deposit to a specific withdrawal.

The three transfers into Ironwood represent about 15% of the ZEC stolen during the Bitget attack.

Other funds from the breach have moved through different blockchain networks and swap services. CoinDesk previously traced around $6.3 million in ether-to-bitcoin conversions through THORChain from a wallet linked to the attacker.

Those transactions produced public records showing the ether sent into THORChain and the bitcoin received afterward, leaving a more visible trail than the transfers conducted within Zcash’s shielded pool.