The attackers behind Bitget's $387.5 million security breach have moved roughly $3.9 million into Zcash's Ironwood shielded pool, according to on-chain activity flagged by blockchain investigator ZachXBT.

Three transactions on Wednesday carried about 2,746 ZEC into the shielded pool, ZachXBT's data showed. That sum represents roughly 15% of the 18,917 ZEC stolen from the exchange. Once funds enter Ironwood, senders, recipients and transaction amounts become obscured, breaking the public trail that investigators rely on to trace stolen assets. Deposits into the pool remain visible, but subsequent movements are considerably harder to link to their origin.

The pivot to privacy infrastructure follows a blocked attempt to move substantially larger sums through cross-chain services. Alex Shevchenko, general manager of NEAR Intents, said wallets tied to the Bitget theft tried to process more than $50 million through the protocol. Its SHIELD risk system rejected most of those transactions before execution, froze roughly $503,000 after swaps had begun, and let about $166,000 pass through.

The rejected assets remained under the attackers' control, leaving them free to pursue other liquidity sources.

THORChain absorbs the overflow

One alternative has been THORChain, the permissionless cross-chain exchange that has resisted Bitget's requests to block addresses linked to the theft. Bitget-linked wallets have repeatedly used the protocol to convert stolen assets into native Bitcoin.

Blockchain analytics firm Bitquery estimated that approximately 29,088 ETH — worth roughly $79 million at the time of its analysis — had been sent into THORChain and swapped for Bitcoin through Sept. 29.

The protocol's volumes have surged as a result. THORChain processed more than $1.5 billion in decentralized exchange volume in the days following the breach, compared with roughly $146 million during the week before the attack, according to DeFiLlama data reviewed by CryptoSlate. The increase coincided with hacker-linked flows, though total volume cannot be attributed solely to the attackers.

The contrast between the two protocols highlights a widening divide over how decentralized infrastructure should respond to identified stolen assets. NEAR has argued that permissionless access does not obligate its liquidity providers to execute known illicit transactions. THORChain has maintained that selective censorship would undermine the principles governing its network.

The disagreement carries practical consequences for Bitget's recovery effort. Blocking one venue does not freeze assets held in self-custodied wallets. It instead forces the attacker to find another source of liquidity, pushing funds toward permissionless exchanges or privacy systems that offer investigators fewer opportunities to intervene.

Bitget restarts operations amid withdrawal rush

The exchange faces a separate operational test as it gradually restores access to customer funds after a four-day withdrawal freeze.

More than $700 million has moved out of tracked Bitget wallets since withdrawal channels began reopening, DeFiLlama data shows. The figure reflects on-chain flows from known exchange wallets rather than Bitget's complete internal withdrawal ledger.

Bitcoin accounted for a sizable portion of the initial rush. Bitget said it had processed 9,585 withdrawal requests totaling 4,098 BTC by Sept. 28, hours after reopening Bitcoin withdrawals. Ethereum withdrawals followed, then USDT across Ethereum, BNB Chain, Solana and Tron.

Bitget Chief Executive Officer Gracy Chen said on Sept. 30 that the exchange's Protection Fund had been rebuilt to more than $300 million, restoring a threshold the company had promised to reach after drawing on the fund following the breach. She said BTC, ETH and USDT withdrawals were already operating and described the business as "gradually back to usual."

The exchange's latest proof-of-reserves snapshot offers another measure of its capacity to withstand the outflows. Bitget reported an overall reserve ratio of 131% across 19 covered assets as of Sept. 29, meaning disclosed assets exceeded corresponding customer balances by 31%.

Bitget plans to reopen withdrawals for its remaining cryptocurrencies, along with fiat and peer-to-peer services, on Friday. That deadline will mark the first full stress test of the exchange's reserves since the breach, just as the attackers' shift into Zcash's shielded pool narrows the window in which investigators can still trace the stolen funds on public ledgers.