Bitget Hackers Move $3.9 Million Into Zcash's Shielded Pool as Losses Hit $388 Million

The group behind the Bitget hack has moved a portion of its stolen funds into Zcash's shielded infrastructure, a step that makes tracing the proceeds significantly harder. Security researcher ZachXBT flagged the transactions on Telegram, identifying a transfer of roughly $3.9 million worth of ZEC, equivalent to 2,746 ZEC, into Ironwood, Zcash's newest shielded pool.

According to the details surfaced by ZachXBT, the funds moved in three separate transactions between 8:15 and 8:46 UTC on Wednesday. The ZEC passed through two intermediary addresses before reaching the shielded pool, originating from a wallet that Bitget has attributed to the attacker. The amount represents approximately 15 percent of the total ZEC stolen in the breach.

The wallet in question had received nearly 18,917 ZEC on September 24, the same day Bitget disclosed the hack. Shielded pools like Ironwood use cryptographic techniques to obscure transaction details, including sender, receiver and amount, making it far more difficult for investigators to follow funds once they enter the pool.

A pattern of obfuscation

The move into Zcash follows earlier efforts by the attacker to launder proceeds through other channels. Around $6.3 million was converted from Ether to Bitcoin via THORChain. Bitget had previously asked THORChain to block the attacker's addresses, a request the network declined to act on.

Taken together, the routing through THORChain and now into Zcash's shielded pool points to a deliberate strategy of spreading the stolen assets across protocols with limited cooperation mechanisms for freezing or tracing funds, complicating recovery efforts for Bitget and investigators tracking the case.

Scale of the breach

Bitget's total losses from the September 24 attack have risen to approximately $388 million, making it one of the larger exchange breaches of the year. The exchange has said it will fully cover the losses using its own protection fund and has gradually resumed withdrawals for affected users since the incident.

For European users and institutions monitoring exchange security, the episode underscores how quickly stolen funds can be dispersed across chains and privacy-preserving protocols once a breach occurs, regardless of the size of the platform's own reserves or its willingness to make customers whole.