Stolen Bitget Crypto Worth $3.9M Vanishes Into Zcash Privacy Network

Key Points

• Approximately $3.9 million in Zcash connected to the Bitget security incident was transferred into Ironwood, a confidential transaction system.
• The movement occurred across three separate transactions totaling 2,746 ZEC during a 31-minute window on Wednesday morning UTC.
• Ironwood’s privacy features completely obscure sender identities, receiver information, and transaction values within the pool.
• This represents roughly 15% of the complete ZEC holdings taken during the September 24 compromise of Bitget.
• Separate tracking revealed prior laundering attempts using THORChain for cross-chain swaps converting approximately $6.3 million from ether to bitcoin.

The perpetrators responsible for the Bitget security compromise have channeled a segment of stolen cryptocurrency into a confidential transaction network, significantly complicating recovery operations. These wallets are associated with an exploit that extracted $387.5 million from the cryptocurrency platform.

During Wednesday’s trading hours, roughly $3.9 million in Zcash value was deposited into Ironwood, a shielded transaction pool representing Zcash’s most advanced privacy infrastructure.

Transaction documentation examined by CoinDesk confirms the deposits occurred through three sequential operations. The timeframe spanned from 08:15 through 08:46 UTC.

The combined transfers totaled 2,746 ZEC entering the confidential system. This quantity accounts for approximately 15% of the entire ZEC allocation compromised in the security incident.

Understanding Zcash’s Privacy Technology

The Zcash blockchain offers dual transaction modes. Traditional transparent transactions function like standard blockchain operations with full public visibility. The alternative employs shielded pools such as Ironwood for confidential transfers.

After cryptocurrency enters a shielded pool, all identifying transaction information vanishes from observable records. Information about who sent funds, who received them, and precise amounts all become completely masked.

While external observers can detect deposits entering the privacy pool, internal activities remain entirely invisible.

Should these assets eventually exit the pool toward transparent addresses, that outbound movement becomes publicly traceable again. Recovery specialists can then attempt analysis.

Forensic approaches include examining temporal patterns and transaction volumes. These methodologies help establish potential correlations between pool deposits and withdrawals, though absolute certainty remains elusive.

Discovery and Attribution

On-chain investigator ZachXBT initially identified these transfers during Wednesday’s monitoring activities. His reputation includes extensive work tracking cryptocurrency exploits and mapping stolen asset movements across wallet networks.

Based on ZachXBT’s analysis, the cryptocurrency flowed through two intermediary addresses before reaching the shielded pool. These intermediate wallets received funding from an address Bitget has officially designated as attacker-controlled.

This identified wallet originally received approximately 18,917 ZEC during the September 24 breach. The recent shielded deposits constitute just a fraction of these total holdings.

Bitget continues pursuing asset recovery initiatives. Routing funds through shielded pools represents a standard obfuscation technique attackers employ to impede or prevent successful recovery operations.

This marks the latest concealment attempt by perpetrators connected to this compromise. CoinDesk has documented additional transfer activity originating from these same attacker-controlled wallets.

Previous investigations revealed approximately $6.3 million in ether underwent conversion to bitcoin. These cross-chain swaps utilized THORChain’s decentralized exchange infrastructure.

Contrasting with Zcash’s shielded approach, THORChain operations maintained transaction visibility throughout. Forensic analysts could observe ether inputs and corresponding bitcoin outputs.

This distinction underscores why Zcash’s privacy pools present substantially greater challenges for tracking specialists. Complete visibility elimination persists throughout the pool residency period.

As of Wednesday evening, no outbound activity from the Ironwood pool had been documented. The compromised funds remain distributed across multiple tracking methodologies, combining both visible blockchain trails and completely obscured holdings.

The post Stolen Bitget Crypto Worth $3.9M Vanishes Into Zcash Privacy Network appeared first on Blockonomi.