Wallets tied to the $387.5 million Bitget breach moved around $3.9 million in zcash (ZEC) into Zcash’s privacy-focused payment system on Wednesday, adding another layer of difficulty for investigators tracking the stolen assets.
CoinDesk’s analysis of blockchain data showed that 2,746 ZEC was deposited into Ironwood, Zcash’s newest shielded pool, through three transactions conducted between 08:15 and 08:46 UTC.
Blockchain investigator ZachXBT was among the first to flag the transfers. He said the funds passed through two intermediary wallets that had received money from an address Bitget identified as being controlled by the attacker. That address received almost 18,917 ZEC during the Sept. 24 hack.
Zcash allows users to make both transparent and shielded transactions. The amount deposited into Ironwood can be observed publicly, but once the funds enter the shielded pool, details including the sender, recipient and transaction amount are concealed.
Funds that later move from the shielded pool to a public address become visible again, including the amount withdrawn. Investigators can study the timing and amounts of deposits and withdrawals, along with other metadata, to look for possible connections. However, the Zcash network does not reveal a transaction path directly linking a deposit to a particular withdrawal.
The three Ironwood deposits account for approximately 15% of the ZEC stolen in the attack.
Other assets linked to the breach have also been moved across different blockchains using swap services. CoinDesk previously tracked roughly $6.3 million worth of ether converted into bitcoin through THORChain from a wallet associated with the attacker. Unlike the shielded Zcash transfers, those swaps produced publicly visible records showing the ether entering and bitcoin leaving the service.
