Wallets connected to the $387.5 million Bitget hack have transferred about $3.9 million worth of zcash (ZEC) into Zcash’s shielded payment system, making the stolen funds more difficult to trace.
CoinDesk’s analysis of blockchain transactions found that 2,746 ZEC was deposited into Ironwood, Zcash’s newest shielded pool, through three transfers made between 08:15 and 08:46 UTC on Wednesday.
Pseudonymous blockchain investigator ZachXBT first reported the movements. According to his analysis, the ZEC passed through two intermediary addresses that had been funded by a wallet Bitget identified as belonging to the attacker. That wallet received nearly 18,917 ZEC during the Sept. 24 breach.
Zcash supports both transparent and shielded transactions. Investigators can identify the amount entering Ironwood, but activity within the shielded pool conceals the sender, recipient and amount involved in each payment.
Should the funds later move from Ironwood to a transparent address, the amount withdrawn becomes publicly visible. Investigators can then compare deposits and withdrawals based on timing, amounts and other available metadata. However, the Zcash protocol does not reveal a transaction trail directly connecting a specific deposit with a specific withdrawal.
The three deposits into Ironwood account for about 15% of the ZEC stolen in the Bitget attack.
Other proceeds from the hack have taken different routes across blockchain networks. CoinDesk previously tracked approximately $6.3 million in ether-to-bitcoin swaps through THORChain originating from an attacker-linked wallet.
Those cross-chain swaps left publicly observable records showing the ether deposited and the bitcoin received, unlike transactions conducted within Zcash’s shielded pool.
