Bitget Hacker Hides Stolen Zcash in Privacy Pool

The Bitget hacker has moved 15% of the stolen Zcash to a privacy pool called Ironwood, complicating efforts to track down the stolen funds. The move was detected by anonymous blockchain investigator ZachXBT on September 30, who found that three transactions had taken place between 8:15 and 8:46 UTC, totaling approximately $3.9 million. This represents a small portion of the roughly 18,917 Zcash tokens stolen in the hack.

The use of Ironwood makes it more difficult for investigators to track the funds, as shielded transactions conceal the sender, recipient, and transaction amount. However, investigators can still infer certain fund flows by cross-referencing deposit and withdrawal timing, amounts, and other metadata. Bitget has acknowledged the security incident and stated that user assets are fully backed on a 1:1 basis.

The exchange is working with blockchain analytics firms and law enforcement agencies to freeze and recover funds, but observers note that this move into a privacy pool could reduce the scope of recoverable assets. The hacker had previously swapped approximately $6.3 million worth of Ethereum for Bitcoin via THORChain, leaving public records of the incoming Ethereum and outgoing Bitcoin visible.