Hackers behind the Bitget exchange breach have moved roughly $4 million worth of stolen Zcash into the network's Ironwood private pool, according to on-chain data. The transfers were split across three separate transactions and pushed about 15% of the stolen ZEC into Ironwood, a shielded environment that conceals sender, receiver, and transaction amounts.
The move marks a deliberate shift from transparent to opaque handling of the funds. Zcash offers both transparent and shielded transactions, and the Ironwood pool sits at the private end of that spectrum. Once inside, the coins become effectively invisible to blockchain analysts who rely on public ledger data.
What the Ironwood pool actually hides
Ironwood is Zcash's shielded pool — a section of the network where transaction details are encrypted rather than published. The sender's address, the recipient's address, and the value being moved are all withheld from public view. Only the fact that a shielded transaction occurred is visible on-chain, not who sent what to whom.
That design is what makes it attractive to anyone trying to break the trail of stolen assets. After the three transfers, roughly 15% of the stolen ZEC is now sitting in a place where the usual tracing tools stop working. The remaining 85% is presumably still in transparent addresses or has been moved elsewhere, though the facts available don't specify its current whereabouts.
Why the Bitget hackers went private
The shift into Ironwood is a tactical move. Exchange hacks typically trigger a scramble among investigators, blockchain forensics firms, and the exchanges themselves to freeze or flag the stolen funds. Transparent transactions are easy to follow, and any deposit into a major exchange can be caught and blocked.
Shielded pools remove that visibility. By routing a chunk of the stolen ZEC through Ironwood, the hackers make it harder for anyone to link the coins to the original theft. The $4 million figure and the 15% share give a sense of scale: this isn't a test transaction, it's a meaningful slice of the haul being taken dark.
The tracing problem for investigators
For the teams trying to recover the funds, Ironwood presents a specific kind of dead end. Public blockchain analysis, the standard method for following stolen crypto, doesn't work inside a shielded pool. The transactions exist, but the data that makes them traceable is encrypted.
That doesn't mean the funds are gone forever. Exchanges can still flag deposits if the coins eventually exit the pool and touch a monitored address. But the window for intervention narrows considerably once assets enter Ironwood. Law enforcement and forensics teams would need either a way to see inside the pool or a mistake by the people moving the funds.
What happens when the coins leave
The next pressure point is the exit. If the hackers try to cash out through a regulated exchange, the coins become visible again the moment they move from Ironwood back to a transparent address. That's when anti-money-laundering systems and exchange compliance teams get a second chance to catch them.
The question now is how much more of the stolen ZEC follows the same path. Fifteen percent is already inside Ironwood. The remaining 85% could stay put, move through transparent channels, or be shielded in additional batches. Each transfer into the private pool shrinks the trail a little further, and there's no public deadline forcing the hackers to reveal their next step.
