The attacker behind the $387.5 million Bitget hack has begun moving stolen Zcash into the cryptocurrency’s privacy-preserving shielded pool, complicating efforts by investigators to follow a portion of the stolen assets.

Approximately $3.8 million of ZEC linked to the exploiter had been transferred from publicly visible addresses into Zcash’s shielded pool as of October 1, according to onchain monitoring of addresses associated with the breach.

The movement is significant because transactions entering Zcash’s shielded system can obscure information that would otherwise remain publicly visible on a blockchain, including links between sending and receiving addresses and, depending on the transaction type, amounts.

It does not mean the ZEC has disappeared from the Zcash network or necessarily been successfully converted into fiat currency.

Instead, investigators can see stolen funds entering the privacy system but may lose the straightforward transaction trail available while the assets remain in transparent Zcash addresses.

Shielded Pool Complicates Tracking of Stolen ZEC

Zcash supports both transparent and shielded transactions. Transparent addresses operate more like conventional public blockchains: transactions and balances can be inspected onchain. Shielded transactions use zero-knowledge proofs to allow the network to verify that a transaction is valid without publicly revealing all of its underlying information.

For an attacker holding traceable stolen cryptocurrency, moving ZEC from a known transparent address into the shielded pool can therefore break the simple address-to-address trail used by blockchain analytics companies.

That makes the latest movement materially different from transferring stolen tokens between ordinary public addresses.

However, privacy does not automatically make the funds impossible to investigate.

Researchers can continue monitoring deposits into and withdrawals from shielded pools and combine timing, transaction values, exchange deposits and other offchain information when attempting to identify subsequent movements. Exchanges can also block deposits from addresses already associated with an exploit where those links remain observable.

The $3.8 million moved so far also represents only around 1% of Bitget’s revised $387.5 million loss, meaning the overwhelming majority of assets associated with the incident are not accounted for by these Zcash privacy transfers.

Bitget Hack Spreads Across Multiple Networks

Bitget initially estimated losses from its September 24 breach at approximately $351.6 million before revising the figure to $387.5 million after identifying additional affected Zcash and TRON assets.

The company has said the revision reflected a more complete accounting of the original incident rather than a second hack.

Security analysis has also challenged the assumption that attackers simply obtained Bitget’s wallet private keys.

GoPlus attributed the breach to a compromise of the exchange’s transaction-signing trust chain, in which fraudulent transaction information was allegedly able to reach an authorized signing process and receive valid signatures.

Bitget has said its cold wallets remained unaffected and customer balances remain fully backed.

The attacker has meanwhile encountered resistance when attempting to move stolen assets through other crypto infrastructure.

NEAR Intents said it rejected attempts to route more than $50 million linked to the Bitget exploiter through its cross-chain system and separately froze approximately $503,000 that had already entered its infrastructure. An attempted route through Chainflip was also rejected at the broker layer before execution through the protocol.

Zcash presents a different challenge because its privacy technology operates at the blockchain level rather than through a centralized intermediary capable of freezing a transaction.

That does not establish that the attacker has successfully laundered the ZEC or realized its value.

But moving approximately $3.8 million from identifiable stolen addresses into the shielded pool represents a meaningful escalation in the laundering phase of the attack: the funds remain onchain, while the public trail investigators use to follow them becomes substantially less transparent.