Bitget’s hackers turn to Zcash after $50 million laundering route gets blocked

Hackers behind Bitget’s $387.5 million breach are turning to Zcash's privacy features to hide the stolen funds as crypto firms increasingly block other escape routes.

About 2,746 ZEC worth roughly $3.9 million was transferred Wednesday into Zcash’s Ironwood shielded pool through three transactions, according to on-chain activity flagged by blockchain investigator ZachXBT. The amount represents about 15% of the 18,917 ZEC stolen from the exchange.

The transfers complicate Bitget’s recovery effort because transactions inside Ironwood can conceal senders, recipients, and amounts, breaking the public transaction trail investigators use to follow stolen assets. Deposits into the pool remain visible, but subsequent movements become considerably harder to link to their origin.

The shift toward Zcash's privacy infrastructure follows attempts by the attackers to move substantially larger sums through cross-chain services, some of which have begun refusing the transactions.

NEAR Intents General Manager Alex Shevchenko said wallets connected to the Bitget theft attempted to process more than $50 million through the protocol. Its SHIELD risk system rejected most of those transactions before execution, while roughly $503,000 was frozen after swaps had begun and about $166,000 successfully passed through.

The rejected assets remained under the attackers’ control, leaving them free to seek alternative routes. The latest Zcash transfers show how that contest is shifting as stolen funds encounter tighter screening across parts of the crypto market.

THORChain volume surges as hackers seek other routes

One alternative has been THORChain, the permissionless cross-chain exchange that has resisted Bitget’s requests to block addresses linked to the theft.

Bitget-linked wallets have repeatedly used the protocol to turn stolen assets into native Bitcoin. Bitquery estimated that about 29,088 ETH, worth roughly $79 million at the time of its analysis, had been sent into THORChain and swapped for Bitcoin through Sept. 29.

As a result, activity on the decentralized exchange has exploded since the breach. THORChain has processed more than $1.5 billion in DEX volume in the days following the incident, compared with roughly $146 million during the week before the attack, according to DeFiLlama data reviewed by CryptoSlate.

The increase has coincided with hacker-linked flows, although total THORChain volume cannot be attributed to the attackers.

THORChain's actions, in contrast to NEAR, highlight a widening divide over how decentralized infrastructure should respond when it identifies stolen assets.

NEAR has argued that permissionless access does not require its liquidity providers to execute known illicit transactions. However, THORChain has maintained that selective censorship would undermine the principles governing its network.

That disagreement has practical consequences for Bitget. Blocking one venue does not freeze assets held in self-custodied wallets. Instead, it forces the attacker to find another source of liquidity, potentially pushing funds toward permissionless exchanges or privacy systems that offer investigators fewer opportunities to intervene.

Bitget absorbs withdrawal rush as operations restart

Meanwhile, Bitget is facing a separate test from its customers as it gradually restores access to funds following the four-day withdrawal freeze.

DeFiLlama data reviewed by CryptoSlate shows more than $700 million has moved out of tracked Bitget wallets since withdrawal channels began reopening, highlighting immediate customer demand to move assets off the exchange. DeFiLlama tracks known exchange wallets, meaning the figure reflects on-chain flows rather than Bitget’s complete internal withdrawal ledger.

Bitcoin accounted for a sizable portion of the initial rush. Bitget said it had processed 9,585 withdrawal requests totaling 4,098 BTC by Sept. 28, hours after reopening Bitcoin withdrawals.

The outflows have continued as the exchange progressively restored other assets. Bitcoin withdrawals reopened Sunday, followed by Ethereum and then USDT across Ethereum, BNB Chain, Solana and Tron. Bitget plans to reopen withdrawals for its remaining cryptocurrencies as well as fiat and peer-to-peer services on Friday.

On Sept. 30, Bitget's Chief Executive Officer Gracy Chen said that the exchange's Protection Fund had also been rebuilt to more than $300 million, restoring a threshold the company had promised to reach after drawing on the fund following the breach.

She said BTC, ETH and USDT withdrawals were already operating and described the business as “gradually back to usual.”

The exchange’s latest proof-of-reserves snapshot provides another measure of its ability to withstand the withdrawals. Bitget reported an overall reserve ratio of 131% across 19 covered assets as of Sept. 29, meaning the assets included in its disclosure exceeded corresponding customer balances by 31%.

Those figures will face a broader stress test when Bitget removes the remaining withdrawal restrictions Friday.