Wallets tied to the $387.5 million Bitget hack moved roughly $3.9 million in Zcash into the cryptocurrency's private payment system on Wednesday, complicating efforts to trace the stolen funds as the exchange pursues recovery.

A CoinDesk review of transaction records shows 2,746 ZEC entered Ironwood, Zcash's newest shielded pool, in three transfers between 08:15 and 08:46 UTC. The deposits represent about 15% of the ZEC stolen in the Sept. 24 breach.

Pseudonymous blockchain investigator ZachXBT first flagged the movements on Wednesday. He said the funds passed through two intermediary addresses funded by a wallet that Bitget identified as belonging to the attacker. That wallet received nearly 18,917 ZEC during the September breach.

What does the shielded pool change?

Zcash supports both public and private transactions. Observers can see how much cryptocurrency enters a shielded pool, but transfers inside it conceal the sender, recipient and transfer amounts.

That structure breaks the direct link between a later withdrawal and the stolen coins. Investigators can still work with timing patterns and transaction values when funds return to publicly visible addresses, but the shielding step raises the cost and uncertainty of on-chain tracing.

Where has the rest of the money gone?

The remaining stolen ZEC has not stayed put. Other proceeds from the breach have moved across blockchains through swap services. CoinDesk previously traced roughly $6.3 million in ether-to-bitcoin swaps through THORChain from one attacker-linked wallet.

Unlike the Ironwood deposits, those swaps left a public record of the incoming ether and the outgoing bitcoin. THORChain has also rejected Bitget's request to block the hacker as approximately $6 million moved into bitcoin, leaving the exchange to pursue other recovery avenues.

Why does this matter for recovery?

The move into Zcash's shielded pool signals a deliberate laundering strategy rather than opportunistic conversion. By splitting proceeds between privacy-preserving infrastructure and cross-chain swap services with transparent records, the attackers are forcing investigators to track multiple obfuscation layers simultaneously.

For Bitget, the operational consequence is straightforward: assets routed through shielded pools cannot be frozen at the destination, and any return to public addresses becomes the next realistic intervention point. Expect tracing teams to monitor Zcash withdrawals from Ironwood for amounts and timings consistent with the stolen 18,917 ZEC as the recovery effort continues.