Hackers linked to the $387.5 million Bitget breach have moved about $3.9 million of stolen cryptocurrency into Zcash’s shielded pool, according to CryptoSlate, after a larger attempted route through the NEAR protocol was largely blocked.
The transfer adds a new layer of difficulty for investigators and Bitget as they try to track and recover assets from the exchange hack. It also shows how attackers are shifting between crypto infrastructure providers as some services screen or reject transactions connected to the theft.
Stolen Zcash enters the shielded pool
Around 2,746 ZEC, worth approximately $3.9 million at the time of the reported transfers, entered Zcash’s Ironwood shielded pool through three transactions on Wednesday. Blockchain investigator ZachXBT identified the on-chain activity.
The amount represents roughly 15% of the 18,917 ZEC that was stolen from Bitget. Zcash is a cryptocurrency that offers both transparent and shielded transaction options. Its shielded pools are designed to conceal transaction details, including the sender, recipient and amount, from public blockchain observers.
The deposit into Ironwood can still be seen on-chain. However, movements made within the shielded pool are substantially more difficult to connect to the original source. That weakens the public transaction trail normally used by investigators to follow stolen digital assets.
The move came after wallets associated with the attackers attempted to send more than $50 million through NEAR Intents, according to Alex Shevchenko, general manager of NEAR Intents. The protocol’s SHIELD risk system rejected most of the attempted transactions before they were completed. About $503,000 was frozen after swaps had started, while approximately $166,000 successfully moved through the system.
The assets rejected by NEAR were not automatically recovered. They remained in the attackers’ control, allowing them to look for other venues and methods. The shift into Zcash indicates that the effort to move the stolen funds is continuing despite tighter screening in parts of the crypto market.
THORChain remains a major alternative route
Another route has been THORChain, a permissionless cross-chain exchange that has not accepted Bitget’s requests to block addresses associated with the breach. Permissionless protocols allow users to exchange assets without the same type of central gatekeeping found at a conventional exchange, although the treatment of suspected illicit funds has become a point of dispute.
Wallets linked to the Bitget theft have repeatedly used THORChain to convert stolen assets into native Bitcoin. Bitquery estimated that about 29,088 ETH, valued at roughly $79 million when analyzed, had been sent through THORChain and exchanged for Bitcoin through Sept. 29.
The activity has coincided with a sharp increase in THORChain’s overall trading volume. DeFiLlama data reviewed by CryptoSlate showed that the decentralized exchange processed more than $1.5 billion in volume in the days after the breach, compared with about $146 million during the week before the attack. The full volume cannot be attributed to the hackers, but the linked flows have been a notable part of the activity.
The responses from NEAR and THORChain illustrate a broader disagreement over how decentralized networks should handle assets associated with theft. NEAR has said that permissionless access does not mean liquidity providers must process transactions they identify as illicit. THORChain, by contrast, has maintained that selectively censoring transactions would conflict with the principles of its network.
For Bitget, blocking one service does not freeze assets held in wallets controlled by the attackers. It can instead push them toward another liquidity source or toward privacy-focused systems, where tracing and intervention become more difficult.
Bitget faces customer withdrawals as access returns
While the stolen funds continue to move, Bitget is also managing a surge in withdrawals after a four-day freeze. More than $700 million has left tracked Bitget wallets since withdrawal channels began reopening, based on DeFiLlama data reviewed by CryptoSlate.
That figure represents on-chain movements from wallets identified as belonging to the exchange, not Bitget’s complete internal withdrawal ledger. It nevertheless indicates strong immediate demand from customers seeking to move assets away from the platform.
Bitcoin made up a substantial part of the initial outflow. Bitget said it had processed 9,585 withdrawal requests totaling 4,098 BTC by Sept. 28, shortly after Bitcoin withdrawals reopened. Ethereum withdrawals followed, and USDT withdrawals were restored across Ethereum, BNB Chain, Solana and Tron. The exchange said it planned to restore withdrawals for its remaining cryptocurrencies, along with fiat and peer-to-peer services, on Friday.
On Sept. 30, Chief Executive Officer Gracy Chen said Bitget’s Protection Fund had been rebuilt to more than $300 million. She said BTC, ETH and USDT withdrawals were operating and described the exchange as gradually returning to normal.
Bitget also reported an overall reserve ratio of 131% across 19 covered assets as of Sept. 29. In that disclosure, the assets included exceeded corresponding customer balances by 31%. The exchange’s financial position will face a wider test when the remaining withdrawal restrictions are removed.
Moneyiar market picture
Moneyiar data at 09:43-09:44 on Oct. 1, 2026, put Zcash at $1,407.5691329573, up 0.01% over 24 hours but down 4.72% over seven days. ApeCoin was $0.1499954147, down 1.29% in 24 hours and up 2.25% over seven days. Cap traded at $0.0742479166, with gains of 19.41% over 24 hours and 50.42% over seven days. Sentient was $0.0219959301, up 3.71% over both periods.
