Wallets tied to the $387.5 million Bitget breach have moved 2,746 ZEC—worth about $3.9 million—into Ironwood, Zcash’s newest shielded pool, on Wednesday, September 30, 2026. Blockchain investigator ZachXBT first flagged the transfers, which occurred in three transactions between 08:15 and 08:46 UTC. The ZEC passed through two intermediary addresses funded by a wallet Bitget identified as attacker-controlled; that wallet had received nearly 18,917 ZEC during the September 24 attack.
The three transfers represent roughly 15% of the stolen ZEC. Once inside Ironwood, Zcash’s shielded architecture hides the sender, recipient, and amount for subsequent shielded transfers. Investigators can see funds entering and later exiting the pool, but the protocol does not expose a direct transaction trail connecting deposits to withdrawals. This makes tracing substantially harder than the earlier route in which roughly $6.3 million in Ether was converted to Bitcoin through THORChain, leaving publicly visible entry and exit amounts. The move also comes as Zcash records its highest weekly shielded transaction count since 2022, with more than 62,000 shielded transactions in a single week.
Bitget has said the original exploit targeted a third-party security product and transaction-signing infrastructure, not private keys, and affected assets across Ethereum and other EVM networks, XRP Ledger, Zcash, and Tron. The exchange’s loss estimate rose from an initial $351.6 million to $387.5 million after Zcash and Tron assets were included during reconciliation. Recovery efforts include security firms, exchanges, a bounty programme, and published attacker addresses. Other routes have been blocked or rejected: a broker refused a Chainflip attempt, and NEAR Intents said it blocked more than $50 million in Bitget-linked assets and froze another $503,000. Zcash privacy is protocol-level, so the Ironwood move cannot be stopped by an intermediary before settlement.
