Bitget Attackers Shield $3.9 Million in ZEC Through Ironwood
Wallets tied to Bitget’s $387.5 million breach moved 2,746 ZEC into Zcash’s Ironwood shielded pool, complicating recovery by hiding later sender, recipient and amount data.
CoinDesk reported that wallets linked to Bitget’s $387.5 million hack shifted about $3.9 million in zcash into Zcash’s private payment system on Wednesday, narrowing what investigators can see while Bitget works to recover the stolen assets.
Transaction records reviewed by the outlet show 2,746 ZEC routed to Ironwood during three transfers from 08:15 to 08:46 UTC.
Ironwood is Zcash’s newest shielded pool, and the move came less than a week after the Sept. 24 breach, changing part of the stolen balance from traceable address activity into privacy-protected flow.
Pseudonymous investigator ZachXBT first flagged the transfers earlier Wednesday.
The funds moved through two intermediary addresses funded by a wallet Bitget had identified as belonging to the attacker, after that wallet received nearly 18,917 ZEC during the breach.
Zcash supports both public and private payments, creating a split investigative path.
Entry amounts into Ironwood can still be observed, but activity after those deposits conceals who sends value, who receives it and how much changes hands.
If money later exits to a public address, investigators can compare exit size, timing and other metadata with the earlier deposits, without receiving a direct on-chain link from Zcash itself.
The deposits account for roughly 15% of the stolen ZEC.
Separate proceeds have already crossed blockchains through swap services, including about $6.3 million in ether-to-bitcoin swaps through THORChain from one attacker-linked wallet.
Those swaps left public records of incoming ether and outgoing bitcoin, giving investigators a clearer chain than the shielded Zcash movements.
For Bitget and blockchain investigators, the unresolved question is whether the stolen ZEC later returns to public addresses in patterns strong enough to support tracing.
Until then, the Ironwood activity reduces direct visibility and pushes recovery work toward timing analysis, exit monitoring and links outside the shielded pool.
