Hackers behind Bitget's $387.5 million breach are increasingly turning to Zcash's privacy features to obscure stolen funds as exchanges and protocols tighten their defenses against illicit asset flows.
According to blockchain investigator ZachXBT, approximately 2,746 ZEC worth roughly $3.9 million was transferred into Zcash's Ironwood shielded pool through three transactions on Wednesday. This represents about 15% of the 18,917 ZEC stolen from the exchange.
Transactions within Ironwood's shielded pool conceal senders, recipients, and amounts, effectively breaking the public transaction trail that investigators rely on to track stolen assets. While deposits into the pool remain visible, subsequent movements become significantly harder to trace to their origin.
Blocking Major Transfer Routes
The shift toward Zcash follows failed attempts to move substantially larger sums through cross-chain services. According to Alex Shevchenko, General Manager of NEAR Intents, wallets connected to the Bitget theft attempted to process more than $50 million through the NEAR protocol. The platform's SHIELD risk system rejected most transactions before execution, while approximately $503,000 was frozen mid-swap and roughly $166,000 successfully passed through.
Alternative Routes Through THORChain
THORChain, a permissionless cross-chain exchange, has emerged as an alternative route for the attackers. Unlike NEAR, THORChain has resisted Bitget's requests to block addresses linked to the theft. According to Bitquery analysis, approximately 29,088 ETH worth roughly $79 million had been sent into THORChain and swapped for Bitcoin by September 29.
THORChain's volume has surged following the breach. The protocol processed more than $1.5 billion in DEX volume in the days after the incident, compared with approximately $146 million during the week prior, according to DeFiLlama data.
The divergent responses highlight a philosophical divide within decentralized finance. NEAR argues that permissionless access does not obligate liquidity providers to execute known illicit transactions, while THORChain maintains that selective censorship would undermine its network principles.
Bitget Recovery Efforts
Bitget is managing significant outflows as it gradually restores customer access following a four-day withdrawal freeze. More than $700 million has moved out of tracked Bitget wallets since withdrawal channels began reopening, reflecting immediate customer demand to secure their assets.
Bitcoin withdrawals reopened on Sunday, followed by Ethereum and USDT across multiple blockchains. Bitget plans to restore withdrawals for remaining cryptocurrencies, fiat services, and peer-to-peer services on Friday.
On September 30, Bitget CEO Gracy Chen announced that the exchange's Protection Fund had been rebuilt to more than $300 million. The exchange reported a reserve ratio of 131% across 19 covered assets as of September 29, meaning disclosed assets exceeded corresponding customer balances by 31%.
