Wallets associated with the $387.5 million Bitget hack have transferred about $3.9 million worth of Zcash into Ironwood, the cryptocurrency’s newest shielded pool, according to CoinDesk. The move places part of the stolen ZEC inside a system designed to conceal key transaction details, making the funds more difficult to trace.
About $3.9 million enters Zcash’s private pool
Transaction records reviewed by CoinDesk show that 2,746 ZEC entered Ironwood in three transfers on Wednesday, Sept. 30, between 08:15 and 08:46 UTC. Based on the amount of Zcash taken in the breach, the deposits represent about 15% of the stolen ZEC.
The funds were routed through two intermediary addresses. Those addresses had previously received their ZEC from a wallet identified by Bitget as belonging to the attacker, according to pseudonymous blockchain investigator ZachXBT. That attacker-linked wallet received nearly 18,917 ZEC during the Sept. 24 breach.
Bitget is the cryptocurrency exchange affected by the hack, which involved $387.5 million in stolen assets. The movement of the Zcash portion into Ironwood adds another complication for efforts to follow and potentially recover the proceeds.
Zcash supports both transparent and shielded payments. In the transparent part of the network, transaction information can be viewed on the blockchain. Ironwood is a shielded pool, meaning that activity within it is designed to conceal the sender, recipient and amount of a transfer.
The deposits into the pool are visible: investigators can see the ZEC entering Ironwood. Once the funds move within the shielded system, however, the blockchain does not provide a public transaction trail connecting one shielded payment to another.
Tracking remains possible, but more difficult
The use of Ironwood does not necessarily make the funds impossible to monitor. If some of the ZEC later leaves the shielded pool for a public address, the amount of that outgoing transfer becomes visible again.
Investigators may then compare the timing and value of deposits and withdrawals, along with other available metadata, to develop possible links. However, Zcash itself does not reveal a direct connection between a specific deposit and a later withdrawal from the private pool.
That distinction is important in a cryptocurrency investigation. Public blockchains can expose a sequence of wallet addresses and transaction amounts, allowing analysts to follow funds as they move. Shielded systems are designed to limit that visibility by withholding information about the parties and value involved in internal transfers.
The three Ironwood deposits therefore mark a change in how the relevant ZEC can be observed. The entry into the pool remains on the public record, but subsequent activity inside the pool is less transparent than movements between ordinary public addresses.
Other stolen assets have crossed blockchains
The Zcash transfers are not the only movement linked to the Bitget incident. CoinDesk previously traced about $6.3 million in ether-to-bitcoin swaps through THORChain from one wallet associated with the attacker.
Those swaps produced a public record of the ether entering the service and bitcoin leaving it. That differs from the Ironwood transfers, where the key issue is the privacy provided after the ZEC enters Zcash’s shielded pool.
The varying routes show why investigators may examine several layers of blockchain activity at once: the original attacker-linked wallets, intermediary addresses, cross-chain swap services and privacy-focused transaction systems. Each step can expose different information and create different challenges for tracing the assets.
Current market picture
Moneyiar market data at 09:03 on Oct. 1, 2026, put Zcash (ZEC) at $1,409.721583253, up 0.45% over 24 hours but down 6.59% over seven days. The same Moneyiar data showed OriginTrail (TRAC) at $0.4930970304, up 21.26% in 24 hours and 37.55% over seven days; FUNToken (FUN) at $0.0079018505, up 11.53% and 1.75%, respectively; and Loaded Lions (LION) at $0.0015459972, up 2% over 24 hours and 4.44% over seven days.
The investigation is ongoing, and the movement of funds into Ironwood is a developing part of the effort to track assets stolen in the Bitget breach.
