Bitget's $387M Hackers Just Went Dark: $3.9M Vanished Into Zcash's Shield
The thieves behind crypto's biggest 2025 breach just found a new escape hatch, and it's one that's nearly impossible to follow.
After their primary $50 million laundering corridor got blocked by coordinated action from crypto firms, the hackers behind Bitget's $387.5 million exploit pivoted Wednesday to Zcash's Ironwood shielded pool, a privacy layer so opaque that even the best on-chain investigators lose the trail once funds enter it. Blockchain sleuth ZachXBT flagged the move, identifying three transactions totaling 2,746 ZEC, worth approximately $3.9 million at current prices.
Why Zcash and Why Now
Zcash's shielded pool uses zero-knowledge cryptography to sever the on-chain link between sender and receiver. Unlike Bitcoin mixing services or Tornado Cash, which have been sanctioned and largely dismantled, Zcash's privacy is baked into the protocol itself. You cannot sanction math.
That's exactly the point. When exchanges, bridges, and OTC desks started flagging wallet addresses tied to the Bitget breach, the hackers needed a tool that doesn't rely on third-party infrastructure. Zcash's Ironwood shielded pool is that tool. Funds go in visible. They do not come out traceable.
The $3.9 million moved Wednesday is a test run. With $387.5 million still largely unaccounted for, this is almost certainly the beginning of a longer, quieter laundering campaign through privacy coins.
The Bigger Problem Nobody Is Saying Out Loud
This pivot signals something important for the entire crypto compliance ecosystem. Industry-wide blocking efforts clearly work well enough to force behavioral change in sophisticated threat actors. That is the good news. The bad news is that those same actors are now gravitating toward tools that existing compliance infrastructure cannot touch.
Every time a laundering route gets shut down, the next route chosen is harder to track. Zcash today. Monero tomorrow. The game is escalating.
For exchanges, this is a five-alarm warning. Any ZEC withdrawal requests from new or unverified wallets in the coming weeks deserve heightened scrutiny. The amounts will likely be structured to stay below automatic review thresholds.
What to Watch Right Now
ZachXBT's continued monitoring of these wallets is your best real-time feed. Watch for additional ZEC accumulation at any major exchange, sudden spikes in Zcash shielded transaction volume, and any OTC desk announcements about tightened ZEC withdrawal policies.
For traders holding ZEC, be clear-eyed: short-term volume bumps tied to illicit flows are not a bullish signal. Regulatory scrutiny of Zcash will intensify directly as a result of this story.
The hackers are still moving. The clock is running.