Bitget Hack Sends $3.9 Million to Zcash Pool
The stolen ZEC ended up in Zcash’s Ironwood pool, where transactions are shielded. That makes tracing harder while Bitget tries to recover the money.
Key Takeaways
- About $3.9 million in Zcash was moved on Wednesday from wallets linked to the Bitget hack to the shielded pool Ironwood.
- CoinDesk saw 2,746 ZEC arrive in three transactions; according to ZachXBT, the money moved through two intermediary addresses controlled by the attacker.
- Because the private Zcash pool hides the sender, receiver, and amount, stolen funds are harder to track.
Wallets linked to the hack at Bitget moved about $3.9 million (€3.4 million) in Zcash on Wednesday to the coin’s private payment system. That makes the stolen funds harder to track, while the crypto exchange tries to recover the money.
Money Disappears Into Ironwood
CoinDesk saw in transaction data that 2,746 ZEC landed in Ironwood, Zcash’s newest shielded pool, in three transfers between 08:15 and 08:46 UTC. Pseudonymous blockchain researcher ZachXBT pointed out the movements earlier on Wednesday. According to him, the money moved through two intermediary addresses funded by a wallet that Bitget identified as belonging to the attacker.
The wallet received nearly 18,917 ZEC during the breach on September 24. The three deposits into Ironwood represent about 15% of the stolen ZEC.
Why This Is Hard to Track
Zcash offers both public and private payments. Outside the shielded pool, you can see how much ZEC is sent, but inside the pool the sender, receiver, and amount stay hidden. That makes it harder to directly connect a later withdrawal to the stolen coins, although timing and amounts can still provide clues if the money moves back to public addresses.
Ironwood was activated in July 2026 and is the latest step in Zcash’s privacy infrastructure, after Sprout, Sapling, and Orchard. The pool is meant to better shield payments, while Zcash itself uses zero-knowledge proofs, which let transactions be verified without revealing all the details.
More Context for Zcash Users
For European crypto readers, this case shows how privacy features in a coin can also be used by attackers to make money flows less visible. That matters for exchanges, researchers, and users who want to understand why recovering stolen crypto often takes time and is not always fully traceable on the blockchain.
CoinDesk previously reported that about $6.3 million (€5.5 million) in ether-to-bitcoin swaps moved through THORChain from another attacker-linked wallet. Those swaps still left a public trail of incoming ether and outgoing bitcoin, but in a shielded pool that trail mostly disappears.
The broader fallout from the Bitget attack also continues: the exchange had already restarted withdrawals in phases after the damage was assessed and security was tightened.
