Bitget hackers move $4 million into Zcash’s private pool, making funds harder to trace

Wallets linked to Bitget’s $387.5 million hack moved about $3.9 million in zcash (ZEC) into the cryptocurrency’s private payment system on Wednesday, making the stolen funds harder to follow as the exchange tries to recover them.

CoinDesk’s review of transaction records found that 2,746 ZEC entered Ironwood, Zcash’s newest shielded pool, in three transfers between 08:15 and 08:46 UTC.

Pseudonymous blockchain investigator ZachXBT first flagged the movements earlier Wednesday. The money came through two intermediary addresses funded by a wallet that Bitget identified as belonging to the attacker, he said, which received nearly 18,917 ZEC during the Sept. 24 breach.

Zcash offers both public and private payments. Investigators can see the amount crossing into Ironwood, but transfers inside the shielded pool hide the sender, recipient and amount.

If funds later return to a public address, the amount leaving the pool becomes visible again. Investigators can compare those entry and exit points using timing, amounts and other metadata, but Zcash itself does not expose a transaction trail linking one to the other.

The three deposits represent about 15% of the stolen ZEC. Other proceeds have moved across blockchains through swap services: CoinDesk previously traced about $6.3 million in ether-to-bitcoin swaps through THORChain from one attacker-linked wallet. Those swaps left a public record of the incoming ether and outgoing bitcoin.

Read More: THORChain rejects Bitget request to block hacker as $6 million moves to bitcoin

(This is a developing story.)