Bitget Breach Hackers Move Millions to Zcash's Private Pool
Hackers behind the $387.5 million Bitget breach transferred between $3.8 million and $4 million in stolen Zcash to Ironwood, the protocol's privacy-shielded pool, after swap platforms rejected their transactions. The move obscures sender, recipient, and transaction amounts on-chain as traditional laundering routes tighten.
Written by CoinArticle’s AI Newsroom · from 4 cited sources. How we work
Story Updates
- Updated Oct 3, 2026, 06:05 PM: Crypto Briefing reports regulatory pressure on privacy coins accelerating as law enforcement targets both protocols and custodians.
- Updated Oct 3, 2026, 11:07 AM: Near Intents rejected the attacker's swap transactions, tightening privacy coin exit routes further.
How the Funds Moved
Hackers tied to the Bitget breach transferred approximately 2,746 ZEC into Zcash's Ironwood shielded pool through three transactions on Wednesday, according to on-chain activity flagged by blockchain investigator ZachXBT. CoinDesk valued the transfer at about $4 million, while CryptoSlate and Decrypt estimated it at roughly $3.8 million to $3.9 million—a minor discrepancy likely reflecting real-time price variation. The amount represents approximately 15% of the stolen Zcash according to earlier reporting.
Shift in Laundering Strategy
The move to Zcash's privacy features signals a pivot by the attackers as other escape routes have narrowed. Near Intents, a swap platform, rejected the attacker's transactions, according to Decrypt, while a separate $50 million laundering corridor has become blocked, forcing the hackers to seek alternative privacy mechanisms. By depositing funds into Ironwood, the senders can hide the transaction sender, recipient, and amount from public chain analysis—a capability unavailable on Ethereum or Bitcoin where standard addresses expose transaction flows.
This pattern indicates the breach actors are adapting their operational security as exchanges and blockchain surveillance firms improve their ability to track stolen funds. The rejection by swap platforms suggests that privacy coin integrations are becoming gatekeeping points where custodians can intercept illicit activity before funds reach final destinations. Industry observers have highlighted the incident as emblematic of broader challenges in tracing stolen cryptocurrency and the escalating need for enhanced security protocols across exchanges and regulatory oversight.
Regulatory and Security Implications
The breach underscores growing pressure on privacy coin protocols and custodians to implement surveillance or guardrails that could detect and prevent illicit fund flows. Regulators and law enforcement are likely to intensify scrutiny of both privacy-preserving protocols and exchanges that support them, potentially influencing future delisting decisions or KYC requirements on privacy trading pairs.
Why It Matters
For Traders
ZEC spot liquidity and withdrawal routes face intensifying exchange friction; watch for delisting announcements or enhanced KYC requirements on privacy pairs.
For Investors
Regulatory pressure on privacy coins will accelerate as law enforcement targets both protocols and custodians; Zcash adoption risk is rising.
For Builders
Privacy pool adoption by attackers will trigger regulatory demands for transaction surveillance hooks or custodial guardrails in privacy-preserving protocols.
This article is for information only and is not financial advice. Read the full disclaimer.
