Bitget hacker routes $3.8M into a Zcash shielded pool after NEAR blocks its swaps

The wallet behind the $387.5 million drain of crypto exchange Bitget has started pushing some of the stolen funds into a privacy pool on Zcash, according to on-chain investigator ZachXBT.

ZachXBT, as reported by Decrypt on October 4, said the attacker began moving roughly 2,700 ZEC — about $3.8 million — into Ironwood, a shielded pool on the Zcash network that launched July 28. A shielded pool encrypts the sender, the receiver, and the transferred amount, which is what makes it useful to someone trying to break the chain of traceable transactions: once funds enter, outside observers can no longer follow them on-chain.

The move follows the attacker's funds hitting a wall elsewhere. Per Decrypt, NEAR's Intents cross-chain swap system rejected around $50 million in attempted swaps from the hacker, and a party on the recovery side — the report frames this as Near Intents — said it recovered $3.8 million after issuing a 48-hour ultimatum, paired with the message "We have identified you, sir."

Key facts

• Amount drained from Bitget: $387.5 million (ZachXBT, via Decrypt).
• Moved into Zcash's Ironwood shielded pool: ~2,700 ZEC, roughly $3.8 million (ZachXBT, via Decrypt).
• Ironwood launched: July 28, 2026 (Decrypt).
• Swaps blocked by NEAR's Intents system: about $50 million (Decrypt).
• Funds said to be recovered after a 48-hour ultimatum: $3.8 million (Decrypt).

The real-world read

Two $3.8 million figures appear here — the amount reportedly recovered after the ultimatum, and the amount reportedly moved into Zcash — and it isn't clear from the available reporting whether they refer to the same funds or are coincidentally identical. Treat them as separate claims until that's reconciled.

Note who's talking. The "recovery" and the "We have identified you, sir" ultimatum come from the side publicizing the clawback; that's an interested party describing its own win, and the $50 million "rejected" and $3.8 million "recovered" are its figures, not independently confirmed here. The hard on-chain claims — the $387.5 million total and the ZEC moving into Ironwood — rest on ZachXBT's tracing, relayed secondhand by Decrypt. Bitget's own accounting of the loss isn't in hand.

The practical takeaway is narrower than any ultimatum suggests: once funds enter a shielded pool, public tracing largely stops. The recovery pressure appears to have worked on the transparent swap route, which is exactly why the attacker is now reaching for a privacy tool that defeats it.

Opinion, and whose

The implicit claim from the recovery side — that identifying and pressuring the attacker forced a clawback — is their framing, not an established fact. No named analyst quoted here forecasts whether the shielded funds can be recovered.

Sources

• Decrypt (Tier 2, secondary), Oct 4, 2026 — reported the Zcash shielded-pool movement, the $387.5M drain, the ~$50M in rejected NEAR swaps, and the $3.8M recovery, citing on-chain investigator ZachXBT as the primary source for the on-chain figures. Not marketing.

This is news reporting, not financial advice.