Bitget-linked wallets shield $3.9 million in Zcash

Wallets linked to Bitget’s September 24 hack moved 2,746 ZEC, worth about $3.9 million, into Zcash’s Ironwood shielded pool on September 30, making subsequent transfers harder to trace while the exchange pursues recovery. CoinDesk’s review of transaction records found three deposits between 08:15 and 08:46 UTC. The amount is about 15% of the ZEC stolen in the breach, which CoinDesk reported at $387.5 million overall.

What becomes harder to trace inside Ironwood?

Ironwood hides the sender, recipient and amount of transfers made within its shielded pool. The deposits into the pool remain visible: investigators can see how much ZEC entered and when. If the funds later leave for a public address, the amount leaving will also be visible, but Zcash does not publish a transaction trail directly connecting that exit to one of these deposits.

That changes the tracing problem rather than erasing every clue. Analysts may compare entry and exit amounts, timing and other metadata, but those comparisons do not provide the same direct public ledger trail available for transparent transfers. CoinDesk said the funds passed through two intermediary addresses funded by a wallet Bitget identified as attacker-controlled. That wallet received nearly 18,917 ZEC during the September 24 breach.

How does this route compare with the other reported movements?

The Zcash transfer gives investigators less direct visibility inside the pool than a route across transparent chains. CoinDesk previously traced about $6.3 million in ether-to-bitcoin swaps through THORChain from an attacker-linked wallet; those swaps left public records of the incoming ether and outgoing bitcoin. The comparison is about what the ledgers reveal: the Zcash route obscures the internal path, while the reported swaps exposed their asset movements on-chain.

Zcash also supports public payments, so entering Ironwood does not make the deposit itself invisible. The shift is that the pool can conceal the details of later transfers. Its privacy feature serves ordinary users as well as anyone seeking to hide funds, so the pool’s design alone does not establish who made a transfer or what they intend to do with the money.

Why did Ironwood become the destination now?

Ironwood is a recently activated shielded pool, rather than a new response to the Bitget breach. Zcash’s NU6.3 upgrade page says it went live on mainnet on July 28, 2026, and describes it as a new pool designed to make circulating-supply integrity independently verifiable. The upgrade restricted the earlier Orchard pool, with funds leaving Orchard required to pass through a turnstile to enter Ironwood.

For Bitget, the transfer narrows what public-chain observers can directly follow for this portion of the stolen ZEC. It does not establish that the funds have been recovered, frozen or converted. The next useful signals are whether any of the ZEC reappears at public addresses, whether investigators or service providers report a freeze or recovery, and whether the attacker moves the remaining ZEC through the same route.

Source material

• CoinDesk’s review of transaction records — coindesk.com
• Zcash’s NU6.3 upgrade page — z.cash