Key Takeaways
- Cryptocurrency addresses connected to the Bitget exchange attack transferred approximately $3.9 million in Zcash to Ironwood, a privacy-focused payment pool.
- The funds moved through three separate transactions involving 2,746 ZEC tokens between 08:15 and 08:46 UTC on Wednesday.
- Ironwood’s privacy technology conceals sender identities, receiver addresses, and transaction values from public blockchain records.
- These transfers represent roughly 15% of the entire ZEC holdings stolen during the September 24 Bitget security breach.
- Earlier laundering attempts involved converting approximately $6.3 million through THORChain, swapping ether for bitcoin.
The cybercriminals responsible for the Bitget security compromise have transferred a substantial chunk of stolen cryptocurrency into a privacy-enhanced payment network, significantly complicating tracking efforts. The addresses in question are associated with an exploit that extracted $387.5 million from the cryptocurrency exchange.
During Wednesday’s operations, approximately $3.9 million in Zcash cryptocurrency was deposited into Ironwood, a shielded transaction pool. Ironwood represents the most advanced privacy technology currently available on the Zcash blockchain.
Examination of blockchain records by CoinDesk revealed that the deposits occurred through three separate operations. These movements were executed within a 31-minute window starting at 08:15 UTC.
The combined transfers amounted to 2,746 ZEC tokens. This quantity represents approximately 15% of the complete ZEC holdings taken during the security incident.
Understanding Zcash’s Privacy Technology
The Zcash network offers users two distinct transaction types. The first operates transparently, maintaining complete visibility of transaction details. The second utilizes privacy-enhanced shielded pools such as Ironwood.
When cryptocurrency enters a shielded pool, transaction metadata becomes inaccessible to public scrutiny. Information about the originating address, destination address, and transfer amounts all become encrypted.
External blockchain analysts can observe deposits entering the privacy pool. However, they cannot monitor internal movements or activities within the shielded environment.
Should the cryptocurrency eventually exit the shielded pool toward a transparent address, that outbound transfer becomes publicly observable once more. This creates an opportunity for forensic analysis.
Investigators employ heuristic analysis techniques, examining factors such as transfer timing and amount patterns. These methods can potentially correlate outbound transactions with earlier deposits, although definitive linkage remains challenging.
Discovery and Attribution
On-chain investigator ZachXBT initially identified these fund movements on Wednesday. He has established a reputation for monitoring cryptocurrency exploits and mapping stolen asset flows through blockchain networks.
ZachXBT’s analysis indicates the cryptocurrency traveled through two intermediary addresses before reaching Ironwood. These intermediary wallets received funding from an address that Bitget’s security team has attributed to the attacker.
The attributed wallet originally received approximately 18,917 ZEC during the September 24 breach. The recent shielded pool deposits account for only a fraction of that initial haul.
Bitget continues asset recovery operations. Routing funds through shielded pools represents a standard obfuscation technique that attackers employ to frustrate recovery initiatives.
This marks another chapter in the attackers’ ongoing evasion efforts. CoinDesk’s investigation has identified multiple transfer patterns connected to the same compromised wallets.
Previous laundering operations involved converting roughly $6.3 million in ether to bitcoin. These conversions utilized THORChain, a cross-chain decentralized exchange protocol.
THORChain transactions, unlike Zcash shielded transfers, maintain public visibility. Forensic analysts could observe the ether inputs and corresponding bitcoin outputs across the protocol.
This comparison underscores why Zcash’s privacy technology presents more substantial challenges for investigators. It eliminates transaction visibility completely during the shielded period.
As of Wednesday evening, no outbound movements from the Ironwood pool had been detected. The stolen cryptocurrency remains distributed across multiple pathways, some traceable and others concealed behind privacy technology.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
