Bitget Exploiter Shields $3.8M in Zcash as Recovery Effort Continues

Addresses tied to the Bitget exploiter have begun moving approximately 2,700 ZEC worth $3.8 million into Zcash’s Ironwood shielded pool, adding a privacy layer to funds stolen during the exchange’s September 24 breach.

The transfers represent roughly 14% of the 18,900 ZEC taken from Bitget’s hot-wallet infrastructure. Three Ironwood deposits were identified as the funds began leaving the transparent address published in connection with the attack.

Onchain investigator ZachXBT described the wallets as belonging to alleged North Korea-linked attackers. Bitget has not formally attributed the breach to North Korea, and Mandiant and SlowMist remain involved in the forensic investigation.

The ZEC forms part of the roughly $388 million breach that affected hot and warm wallets across Zcash, Ethereum and several EVM networks, XRP Ledger and TRON. The final total increased from the $351.6 million initially identified after additional Zcash and TRON transfers were classified.

Ironwood Obscures the Trail Beyond the Deposit

Zcash activated Ironwood on July 28 as part of its NU6.3 network upgrade, replacing Orchard as the network’s primary shielded pool after a soundness vulnerability was discovered earlier this year.

Shielded Zcash transactions encrypt the addresses and transaction amounts that would otherwise be publicly visible. Once ZEC enters the shielded pool, the public blockchain no longer provides enough information to reconstruct the subsequent payment path without additional disclosure from a participant.

The three identified deposits therefore establish that the stolen ZEC entered Ironwood, but public chain analysis alone cannot follow the same coins through later shielded transfers in the way it can track transparent Zcash addresses.

About 16,200 ZEC from the original 18,900 ZEC remains outside the 2,700 ZEC identified in the latest shielding activity, although additional movements could change that balance.

Recovery Effort Spans Multiple Networks

The Zcash movement comes as Bitget continues trying to freeze or recover funds across several chains and liquidity routes. The exchange has offered a 5% bounty for voluntary assistance that directly results in stolen assets being frozen or returned.

Attempts to stop other portions of the funds have already exposed limits in cross-chain recovery. THORChain rejected requests to restrict addresses connected to the theft, triggering a wider decentralization dispute over whether validator-operated protocols should intervene when publicly identified stolen assets pass through their infrastructure.

Bitget’s Protection Fund held more than $464 million when the breach occurred and has been designated to absorb the financial impact for users. BTC and ETH withdrawals have already resumed, USDT withdrawals reopened on September 30, and remaining token, fiat and P2P withdrawals are scheduled for October 2.

The latest Ironwood transactions leave approximately 16,200 ZEC from the original stolen Zcash balance outside the identified shielded deposits, while tracing and recovery work continues across the other assets taken in the breach.

The post Bitget Exploiter Shields $3.8M in Zcash as Recovery Effort Continues appeared first on Crypto Adventure.