Bitget Hack Wallets Move $3.9 Million in Zcash Into…

Wallets connected to the $387.5 million Bitget security breach moved roughly $3.9 million worth of Zcash into the network's Ironwood shielded pool on Wednesday, according to blockchain investigator ZachXBT. Three transactions sent a combined 2,746 ZEC into the privacy pool between 08:15 and 08:46 UTC. The amount represents about 15% of the ZEC stolen in the Sept. 24 attack.

The funds moved through two intermediary addresses that had been funded by a wallet Bitget identifies as attacker-controlled. That original address received nearly 18,917 ZEC during the breach, which Bitget says exploited a third-party security product and the exchange's transaction-signing infrastructure rather than its private keys. The exchange's final loss estimate of $387.5 million exceeded an initial $351.6 million figure, partly because Zcash and Tron assets were added during reconciliation. The incident affected assets on Ethereum and other EVM networks, XRP Ledger, Zcash and Tron.

Why Ironwood matters

Zcash lets users transact transparently, where addresses and amounts are public, or through shielded transactions that hide payment details. Observers can see the 2,746 ZEC entering Ironwood, but once inside the pool, the protocol no longer publicly reveals the sender, receiver or amount for later shielded transfers. If coins exit to a transparent address, the amount becomes visible again, but Ironwood does not expose a direct link between deposits and withdrawals. Investigators can try to match timing, values and metadata, though the protocol removes a straightforward trail. Ironwood was introduced after developers built a new shielded pool following a critical issue with the older Orchard system. Shielded usage has risen, with Zcash recently logging its highest weekly number of shielded transactions since 2022 — more than 62,000 in one week.

The Zcash route differs from other movements of Bitget-linked funds. An attacker wallet previously swapped about $6.3 million in Ether for Bitcoin through THORChain, but that flow stayed publicly traceable because observers could identify the ETH going in and BTC coming out. A broker recently rejected an attempt to route stolen assets through Chainflip before settlement, while NEAR Intents said its monitoring blocked attempts to move more than $50 million in Bitget-linked assets and froze another $503,000 that had already entered its system. Zcash creates a harder problem because privacy is part of the protocol, not an intermediary that can refuse a transaction.

Bitget has worked with security firms, exchanges and crypto infrastructure providers to freeze and recover assets since the breach, and has launched a recovery bounty and published attacker-linked addresses. Those measures are most effective while funds sit in transparent wallets or pass through centralized services that can block them. The 2,746 ZEC is not necessarily gone forever; the attacker may eventually need to move the coins into transparent addresses, exchanges or other services to convert or spend them, creating new leads. For now, the transfer shows how recovery is getting tougher as the stolen portfolio fragments across networks.