Bitget Hackers Transfer $4 Million to Zcash Privacy Pool to Hide Funds

The wallets involved in the Bitget $387.5 million (roughly Rs. 3,713 crore) hack have sent around $3.9 million (roughly Rs. 37 crore) worth of Zcash (ZEC) to the privacy protocol of Zcash, which makes it difficult to track the stolen money. According to CoinDesk's analysis of transaction data, a total of 2,746 ZEC was transferred to Ironwood, the latest shielded pool of Zcash, through three transactions from 08:15 to 08:46 UTC. These movements were first detected by pseudonymous blockchain sleuth ZachXBT on Wednesday.

Zcash Shielded Transactions Conceal Sender, Recipient and Transfer Amounts

ZachXBT also noted that the cash was transferred via two intermediate wallets that were topped up from a wallet identified as that of the attacker, according to Bitget, which contained almost 18,917 ZEC following the September 24 hack. Zcash provides for both public and private transactions. While investigators may be able to determine the quantity being transferred into Ironwood, transactions within the private network hid all details such as the sender, recipient, and amount.  

If money is sent back to a public address, the amount that exits the pool reappears. This can be matched by investigators using time, money amounts, and other data, but Zcash itself does not give a transaction history connecting the two.

These three deposits make up around 15 percent of the ZEC that has been stolen. The rest of the profits have been transferred through different blockchains via swap services. CoinDesk identified around $6.3 million (roughly Rs. 60 crore) worth of Ether-to-Bitcoin swaps through THORChain originating from one of the attackers' wallets.

Earlier this week, Bitcoin withdrawals were restored by Bitget after the attack. According to Bitget, BTC withdrawals were opened at 08:00 UTC on September 28 as planned, marking the start of the gradual resumption of operations following security reviews of its withdrawal system. The firm stated that the vulnerability that led to the problem has been patched and that there have been no other unauthorised transactions since then. 

Post the attack, NEAR Intents blocked over $50 million (roughly Rs. 480 crore) in cross-chain transactions that it has associated with the wallets connected to the Bitget hack. General Manager of NEAR Intents, Alex Shevchenko, said on September 29 that the protocol's SHIELD mechanism flagged the transaction flows as suspicious and stopped them from being completed via its network.