Hassan Maishera
TL;DR
-
Wallets connected to the Bitget attacker moved approximately $3.9 million in ZEC into Zcash’s Ironwood shielded pool.
-
CoinDesk identified three deposits totaling 2,746 ZEC between 08:15 and 08:46 UTC on Wednesday.
-
Investigator ZachXBT linked the movements to an attacker wallet through two intermediary addresses.
-
The deposits represent roughly 15% of the nearly 18,917 ZEC the identified wallet received during the breach.
Wallets linked to Bitget’s $387.5 million hack moved approximately $3.9 million in zcash into the cryptocurrency’s private payment system Wednesday, complicating efforts to follow the stolen assets.
Analysts’ review of transaction records identified 2,746 ZEC entering Ironwood, Zcash’s newest shielded pool, through three transfers over 31 minutes.
The movement introduces a privacy boundary into the investigation. While the deposits are publicly observable, subsequent transfers within the shielded pool do not reveal the sender, recipient, or amount.
Three Deposits Lead Into Ironwood
The transfers occurred between 08:15 and 08:46 UTC. Pseudonymous blockchain investigator ZachXBT first flagged the activity Wednesday. He said the funds passed through two intermediary addresses financed by a wallet Bitget had identified as belonging to the attacker.
That wallet received nearly 18,917 ZEC during the September 24 breach.
The 2,746 ZEC deposited into Ironwood represents approximately 14.5% of that amount, or roughly 15% of the stolen ZEC identified in the report.
The deposits therefore account for part of the attacker-linked Zcash holdings. They do not establish that all stolen ZEC, or the wider proceeds of the hack, entered the shielded pool.
Zcash supports both public and private payments. Public transactions expose information that investigators can use to follow movements between addresses. Transfers within a shielded pool conceal the sender, recipient, and amount, limiting what can be learned from the public ledger.
In this case, investigators can observe how much ZEC entered Ironwood. Once those assets are inside, however, Zcash does not publish a transaction trail showing their subsequent path.
That makes it harder to connect the visible deposits with later transfers or identify the parties receiving funds inside the pool.
The privacy mechanism applies to shielded transactions generally. Its use by attacker-linked wallets does not itself reveal who ultimately controls or receives the funds after entry.
Public Withdrawals May Still Offer Clues
If funds later leave Ironwood for a public address, the amount exiting becomes visible again.
Investigators can examine those withdrawals alongside the known deposits, comparing timing, amounts, and other available metadata.
Such comparisons may produce investigative leads, but they do not provide a direct ledger link between a particular deposit and withdrawal. Zcash itself does not expose that connection.
The distinction is important: the movements have become harder to trace, but the public entry points have not disappeared. Any subsequent public exits could also provide information for continued analysis.
Other Proceeds Have Moved Through Cross-Chain Swaps
The Ironwood deposits follow other movements of assets associated with the Bitget breach.
Investigators previously traced approximately $6.3 million in ether-to-bitcoin swaps through THORChain from one attacker-linked wallet.
Those swaps left public records of the incoming ether and outgoing bitcoin, allowing investigators to examine both sides of the cross-chain movement.
The Zcash transfers create a different tracing challenge because transaction details are concealed within the shielded pool.
Together, the movements show the recovery effort spanning multiple assets, blockchains, and transaction systems. Some routes preserve an observable trail, while others restrict the information available to investigators.
Bitget is continuing efforts to recover assets stolen in the September 24 attack. The latest deposits establish that a portion of the attacker-linked ZEC entered private transactions. They do not establish its final destination, whether it has subsequently left Ironwood or whether any of that amount has been recovered.
The crypto exchange has resumed withdrawals on its platform, with BTC transfers reopening first and other assets scheduled to follow after security checks.
Three days ago, the hacker moved about $83 million in stolen XRP from initial holding wallets. Meanwhile, NEAR Intents revealed that it rejected more than $50 million in attempted swaps linked to the Bitget hack and froze $503,000, raising questions about who controls access to its service
