Bitget hackers have moved roughly $4 million of the stolen ZEC into Zcash’s private Ironwood pool, making the funds harder to trace as the exchange tries to recover them. The transfers took place Wednesday, pushing about 15% of the ZEC stolen in the Sept. 24 breach into the shielded pool.
The move comes as investigators scramble to track the stolen assets across multiple blockchains. Zcash’s shielded pool conceals the sender, recipient and amount of each transfer, though timing and transaction values can still offer clues when funds return to public addresses.
What Happened on Wednesday
CoinDesk reviewed transaction records and found that 2,746 ZEC entered Ironwood in three transfers between 08:15 and 08:46 UTC. Pseudonymous blockchain investigator ZachXBT flagged the movements earlier Wednesday, noting that the money came through two intermediary addresses funded by a wallet Bitget identified as belonging to the attacker.
That attacker wallet received nearly 18,917 ZEC during the Sept. 24 breach. The three deposits represent about 15% of the stolen ZEC.
Zcash supports both public and private transactions. Investigators can see the amount moving into Ironwood, but once funds enter the shielded pool, the sender, recipient and transfer value are concealed from view.
Why Ironwood Makes Recovery Harder
Ironwood is Zcash’s newest shielded pool. Transfers within it conceal the sender, recipient and amount of each transaction, which means investigators cannot see who sent the money, who received it or how much was involved.
The design is meant to protect privacy by hiding transaction details from public view. For a hacker looking to obscure stolen funds, it is a useful tool.
For an exchange trying to recover those funds, it is a problem. The money is still on the chain — the transfer records show the amount and the timing — but the identities behind the transactions are sealed away. That means investigators lose the ability to follow the money from one address to the next, which is often how recovery operations work.
Other Proceeds Across Blockchains
Not all of the stolen funds went into Ironwood. CoinDesk previously traced about $6.3 million in ether-to-bitcoin swaps through THORChain from one attacker-linked wallet. Those swaps left a public record of the incoming ether and outgoing bitcoin.
“The money came through two intermediary addresses funded by a wallet that Bitget identified as belonging to the attacker.”
That earlier tracing shows how some stolen funds moved openly across chains. The Ironwood deposits now sit on the opposite end of the spectrum — private, hidden and harder to follow.
What Investigators Can Still See
Even with the money locked in Ironwood, investigators are not entirely without tools. If funds return to a public address, the amount leaving the pool becomes visible again. Investigators can compare those entry and exit points using timing, amounts and other metadata.
Zcash itself does not expose a transaction trail linking one to the other. But investigators can piece together a timeline by comparing the timing of entries into Ironwood with the timing of exits back to public addresses. Amounts also help — if a public address receives a payment that matches the size of an Ironwood deposit, that narrows the search.
The Pattern of Movement
The three Ironwood deposits follow a recognizable pattern:
- Three transfers between 08:15 and 08:46 UTC on Wednesday
- About 15% of the stolen ZEC, or roughly $4 million
- Entered through two intermediary addresses
- Funded by a wallet Bitget identified as belonging to the attacker
Each of those facts matters in its own way. The 15% figure shows this is a significant chunk of the stolen funds, not a small test run. And the use of intermediary addresses — funded by the attacker wallet — suggests the hackers knew exactly what they were doing.
What This Means for Bitget
The exchange is now chasing funds across two very different kinds of ledger. Some stolen ZEC moved openly through THORChain, leaving a record investigators can read. Some moved privately into Ironwood, where investigators can only guess.
That is a difficult position to be in. Recovery operations depend on being able to follow the money, and Ironwood breaks that chain. The funds are still on the network, but their movements are hidden from view.
The exchange’s recovery effort will likely focus on monitoring for any exits from Ironwood, while also watching for other signs of movement across the broader ecosystem.
The Bottom Line
The hackers made a deliberate choice to move stolen funds into Zcash’s private pool. They did so in a way that investigators can still partially track — the amount is visible, the timing is visible, the source wallet is known — but the actual transfers themselves remain sealed.
That is a clever move, and it raises the stakes for Bitget’s recovery effort. The exchange now faces a situation where a significant portion of the stolen funds are effectively hidden from public view, while the rest continue to move openly across swap services.
For the moment, the Ironwood deposits sit where the hackers put them. Whether they ever emerge is another question entirely.
Source material: “Bitget hackers move $4 million into Zcash’s private pool, making funds harder to trace,” CoinDesk.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.