Bitget Hackers Move Stolen Funds to Zcash as Exchange Faces Withdrawal Surge
Hackers behind the $387.5 million Bitget breach are shifting stolen ZEC into Zcash's shielded pool to evade detection, while the exchange manages over $700 million in customer outflows following a four-day withdrawal freeze.
Attackers responsible for the $387.5 million Bitget breach are increasingly utilizing Zcash's privacy features to obscure the movement of stolen assets. According to on-chain data flagged by ZachXBT, approximately 2,746 ZEC, valued at roughly $3.9 million, was moved into Zcash’s Ironwood shielded pool on Wednesday. This amount accounts for about 15% of the 18,917 ZEC stolen from the exchange.
The use of the Ironwood pool complicates recovery efforts, as the protocol hides transaction details including sender, recipient, and amount. While initial deposits remain visible, subsequent movements are significantly harder to track. This shift follows failed attempts by the hackers to move larger sums through other services, including the NEAR protocol. Alex Shevchenko, General Manager of NEAR Intents, stated that the SHIELD risk system blocked the majority of a $50 million swap attempt, though about $166,000 successfully passed through and roughly $503,000 was frozen.
Hackers have also turned to THORChain to swap stolen assets for native Bitcoin. Bitquery analysis estimated that approximately 29,088 ETH, worth about $79 million at the time of analysis, was sent into the protocol through Sept. 29. This activity has contributed to a surge in THORChain's volume, which exceeded $1.5 billion in the days following the breach, compared to roughly $146 million in the week prior.
The differing responses from NEAR and THORChain highlight a divide in how decentralized infrastructure handles illicit funds. NEAR argues that liquidity providers should not be required to execute known stolen transactions, while THORChain maintains that selective censorship contradicts its core principles. This disagreement forces attackers to seek out alternative liquidity sources, such as privacy-focused systems.
Meanwhile, Bitget is navigating a significant wave of customer withdrawals as it restores platform access. DeFiLlama data indicates that over $700 million has moved out of tracked Bitget wallets since withdrawal channels began reopening. By Sept. 28, the exchange had processed 9,585 withdrawal requests totaling 4,098 BTC.
Bitget CEO Gracy Chen stated that the company's Protection Fund has been rebuilt to over $300 million. The exchange also reported a reserve ratio of 131% across 19 covered assets as of Sept. 29. Bitget plans to fully restore remaining withdrawal services, including fiat and peer-to-peer options, on Friday.
