The hacker responsible for one of the largest exchange breaches of the year has shifted tactics, funneling stolen funds into Zcash's privacy features after a decentralized swap platform reportedly refused to process their transactions.
Funds Move Into Zcash's Shielded Pool
The attacker behind the $387.5 million Bitget heist has begun concealing roughly $3.8 million worth of ZEC inside Zcash's Ironwood shielded pool, according to on-chain analysis. Shielded pools are a signature feature of Zcash, allowing users to obscure transaction details such as sender, receiver, and amount, making them attractive to those seeking to launder illicit proceeds.
The move to Zcash marks a notable evolution in the hacker's laundering strategy, coming only after other avenues appeared to close off. Privacy-focused assets have increasingly become a tool of choice for bad actors looking to break the traceability that typically defines public blockchains.
When one door slams shut, sophisticated attackers simply find another route to obscure their trail.
Near Intents Reportedly Blocked the Swaps
Before turning to Zcash, the attacker attempted to move around $50 million through Near Intents, but those swaps were reportedly rejected. The refusal forced the hacker to seek alternative methods, ultimately landing on Zcash's privacy pool to keep the laundering effort alive.
The episode highlights the growing tension between DeFi platforms and the illicit activity that can flow through them. As protocols face mounting pressure to prevent facilitating criminal proceeds, some are taking more active steps to screen and reject suspicious transactions.
Key details of the incident include:
- The original Bitget breach involved roughly $387.5 million in stolen assets.
- Near Intents reportedly turned away about $50 million in swap attempts.
- The attacker moved approximately $3.8 million in ZEC into Zcash's Ironwood pool.
What It Means for Tracking Stolen Crypto
The shift underscores the ongoing cat-and-mouse dynamic between blockchain investigators and those seeking to hide stolen funds. While shielded pools complicate tracing efforts, analysts continue to monitor the movements, and the visibility of funds entering privacy tools can itself provide investigative leads.
For exchanges and security firms, the case serves as another reminder of how quickly attackers adapt when their preferred