Crypto: After NEAR, Bitget Hackers Switch Tactics

Hackers linked to the Bitget crypto hack are changing methods. After the failure of an attempt to launder more than 50 million dollars via NEAR Intents, they sent about 2,746 ZEC, nearly 3.9 million dollars, into the protected Ironwood pool of Zcash. Once the funds enter this system, tracking them becomes much more difficult.

Zcash becomes a new route for stolen cryptos

Three transactions were enough. About 2,746 ZEC were sent into Ironwood, the protected Zcash pool. This amount represents nearly 15% of the 18,917 ZEC stolen during the attack on the Bitget crypto platform. The move took place a few days after the Bitget hack, now estimated at 387.5 million dollars.

Zcash allows protected crypto transactions where the sender, recipient, and amount can be hidden. Deposits to Ironwood remain visible on the blockchain, but movements made thereafter inside the pool are much more difficult to link to the original funds.

This does not necessarily make the assets impossible to find. Investigators can still analyze timings, amounts, or future outputs to public addresses.

But the trail becomes less comfortable. This feature partly explains why Zcash remains a reference among privacy-focused cryptos. For investigators tracking Bitget funds, this route change now adds an additional layer.

More than 50 million $ blocked before moving to Zcash

Before Zcash, the hackers tried another route. NEAR Intents claims to have refused more than 50 million dollars in swaps linked to addresses involved in the Bitget hack. The crypto protocol notably uses filtering mechanisms designed to identify certain suspicious funds before their conversion.

The majority of this attempt therefore failed. The funds also moved through THORChain. On this network, the situation was different. Bitget had publicly requested that addresses linked to the theft be blocked, but THORChain did not stop their activity. The protocol operates without a central authority capable of directly freezing an address.

The sequence mainly shows how quickly crypto thieves can change tools. One route closes. Another is tested. Zcash offers exactly what monitoring platforms seek to avoid in this case: a partial break of the public link between funds entry and exit.

The network was not designed for hackers. Its privacy functions can be used by any crypto user wishing to avoid all their payments being publicly visible. The technology simply becomes much more challenging to manage when it encounters stolen assets.

Bitget must now track funds much harder to trace

Bitget has already gradually reopened withdrawals after several days of suspension. Bitcoin returned first, followed by Ethereum and USDT, while other services are to be restored in stages. The exchange states that customer balances remain intact.

The issue now shifts to recovery. According to Bitget, the September 24 attack did not compromise private keys nor cold wallets. The attacker reportedly exploited a vulnerability in a third-party security product to obtain high-level internal credentials and send false withdrawal orders.

The total amount then rose to about 387.5 million dollars after discovering additional transactions, notably on Zcash and Tron. With support from industry partners, investigators have already managed to freeze part of the funds. Mandiant, SlowMist, several crypto exchanges, and on-chain analysis specialists also contribute to tracking assets and monitoring suspicious movements.

But Ironwood changes the nature of the work. A typical crypto transaction leaves a fairly clear trail between two public addresses. A protected Zcash transaction can break this link.

In fact, this mechanism is again drawing market attention. Zcash and Monero recently boosted the market cap of privacy coins to much higher levels. In the Bitget case, about 3.9 million dollars have already taken this route. This is only a fraction of the 387.5 million stolen. For investigators, it is already enough to seriously complicate the trail.