The attacker behind the $387.5 million Bitget hack has begun hiding roughly $3.8 million in ZEC inside Zcash's Ironwood privacy pool. The move follows an attempt to swap about $50 million through Near Intents, which rejected the transactions.
Funds disappear into Zcash's shielded pool
According to on-chain data, the Bitget attacker started depositing approximately $3.8 million worth of Zcash into the Ironwood privacy pool. Ironwood is one of Zcash's shielded pools, designed to obscure transaction details such as sender, receiver and amount. By moving funds there, the attacker makes it harder for investigators and exchanges to trace the money's origin.
The deposit represents a small slice of the $387.5 million taken from Bitget. But it signals a shift in how the attacker is trying to launder the proceeds — away from transparent swaps and toward privacy-focused tools.
Near Intents blocks $50 million swap attempt
Before the Zcash deposits, the attacker tried to swap roughly $50 million through Near Intents, a cross-chain swap service. Near Intents rejected the attempts. The service didn't explain its decision, but the rejection prevented a large portion of the stolen funds from being converted into other assets through that channel.
That rejection likely pushed the attacker toward alternatives. Zcash's Ironwood pool offers a way to break the on-chain link between the stolen funds and their eventual destination. Once inside a shielded pool, the funds can be moved or withdrawn with far less transparency than on a public blockchain.
What the Ironwood pool does — and why it matters
Zcash has long been known for its optional privacy features. Ironwood is a specific shielded pool that uses zero-knowledge proofs to validate transactions without revealing their details. For legitimate users, it's a tool for financial privacy. For an attacker sitting on hundreds of millions in stolen crypto, it's a way to obscure the trail.
The $3.8 million deposit is comparatively small, but it could be a test. If the method works, the attacker may move more funds through the same route. That would complicate recovery efforts for Bitget and any law enforcement agencies involved.
Recovery efforts face a moving target
Bitget has not publicly detailed its recovery plan. The exchange confirmed the $387.5 million hack, but it's unclear whether it has enlisted blockchain forensics firms or notified authorities. The attacker's shift to privacy pools adds a layer of difficulty. Once ZEC enters Ironwood, tracing it requires different techniques than following transparent transactions.
Near Intents' rejection shows that some services are actively blocking the attacker's swaps. But the Zcash deposits suggest the attacker is adapting. The question now is how much of the $387.5 million will follow the same path — and whether any of it can be clawed back before it's fully shielded.
For Bitget users, the immediate concern is whether the exchange will absorb the loss or pass it on. Bitget hasn't said. The attacker, meanwhile, continues to move funds. The next few days will show whether the Ironwood deposits are an isolated move or the start of a broader laundering strategy.
