Wallets linked to the $387.5 million Bitget hack moved about $3.9 million in Zcash into the cryptocurrency's private payment system on Wednesday, complicating ongoing efforts to trace and recover the stolen funds.
Transaction records reviewed by CoinDesk indicate that 2,746 ZEC entered Ironwood, Zcash's newest shielded pool, across three separate transfers between 08:15 and 08:46 UTC. The activity was initially flagged by pseudonymous blockchain investigator ZachXBT.
According to transaction details, the funds originated from two intermediary addresses financed by a wallet previously identified by Bitget as belonging to the attacker. That attacker-linked wallet had received nearly 18,917 ZEC during the September 24 breach, meaning the recent deposits account for roughly 15% of the stolen ZEC.
While Zcash offers both public and transparent transactions, its shielded pools conceal senders, recipients, and transfer amounts. Although investigators can track the initial volume entering a private pool, the internal mixing makes it significantly harder to link subsequent withdrawals back to the original theft. However, analysts note that timing and transaction amounts can still occasionally offer clues when funds eventually return to public addresses.
The movement into privacy-enhancing technology follows other laundering attempts by the hackers. Previously, about $6.3 million in ether-to-bitcoin swaps were traced through THORChain from an attacker-linked wallet, transactions that left a public ledger record of the incoming and outgoing assets.
