Bitget hackers move $3.9 million into Zcash shielded pool after swaps blocked

Hackers behind Bitget's $387.5 million breach moved about 2,746 ZEC, worth roughly $3.9 million, into Zcash's Ironwood shielded pool on Wednesday. Blockchain investigator ZachXBT flagged the three transfers. The amount represents about 15% of the 18,917 ZEC stolen from Bitget. Ironwood deposits remain visible, but transactions inside the pool can conceal senders, recipients and amounts, making subsequent movements harder to trace. NEAR Intents General Manager Alex Shevchenko said wallets linked to the theft attempted to process more than $50 million through the protocol. Shevchenko said NEAR Intents' SHIELD risk system rejected most of those transactions before execution. Shevchenko said roughly $503,000 was frozen after swaps began. Shevchenko said about $166,000 passed through. The rejected assets remained under the attackers' control. Bitget-linked wallets have also repeatedly used THORChain to swap stolen assets for native Bitcoin. THORChain has resisted Bitget's requests to block addresses linked to the theft. Bitquery estimated that about 29,088 ETH, worth roughly $79 million at the time of its analysis, had been sent into THORChain and swapped for Bitcoin through Sept. 29. THORChain processed more than $1.5 billion in decentralized exchange volume in the days after the breach, compared with roughly $146 million during the week before the attack, according to DeFiLlama data reviewed by CryptoSlate. The increase coincided with hacker-linked flows, but not all THORChain volume can be attributed to the attackers. NEAR has argued that permissionless access does not require its liquidity providers to execute known illicit transactions. However, THORChain has maintained that selectively blocking transactions would undermine its network's principles. Blocking a venue does not freeze assets in wallets controlled by the attackers; it forces them to seek another source of liquidity. Bitget is gradually restoring access after a four-day withdrawal freeze. More than $700 million has moved out of tracked Bitget wallets since withdrawal channels began reopening, according to DeFiLlama data reviewed by CryptoSlate. That figure reflects on-chain flows from known exchange wallets, not Bitget's complete internal withdrawal ledger. Bitget said it had processed 9,585 withdrawal requests totaling 4,098 BTC by Sept. 28, hours after Bitcoin withdrawals reopened. Bitcoin withdrawals reopened Sunday, followed by Ethereum and then USDT across Ethereum, BNB Chain, Solana and Tron. Bitget plans to reopen withdrawals for its remaining cryptocurrencies, fiat services and peer-to-peer services on Friday. On Sept. 30, Bitget Chief Executive Officer Gracy Chen said the exchange's Protection Fund had been rebuilt to more than $300 million. Bitget had promised to restore that threshold after drawing on the fund following the breach. Chen said BTC, ETH and USDT withdrawals were operating and described the business as gradually returning to usual. Bitget reported an overall reserve ratio of 131% across 19 covered assets as of Sept. 29. The reported ratio means the assets covered by the disclosure exceeded corresponding customer balances by 31%. The remaining withdrawal restrictions are due to end Friday, providing a broader test of those figures.