Bitget Hack Wallets Move 2,746 ZEC Into Zcash's Ironwood Shielded Pool

2,746 ZEC From the Bitget Breach Reaches Ironwood

2,746 ZEC tied to September's Bitget hack has moved into the Ironwood shielded pool of Zcash (ZEC), the point at which public blockchain records stop tying the funds to identifiable parties or amounts. On-chain investigator ZachXBT flagged the wallets carrying the coins, and the transaction trail shows the money crossed into the shielded pool across three separate inflows. Valued at the Zcash price prevailing when the transfers settled, the tranche was worth about $3.9 million, a figure that covers only these coins, not the exchange's total loss from the attack or what the tokens are worth today. A shielded pool is the portion of Zcash's supply whose transaction history is encrypted rather than published in the open, and it is the destination where exchange-incident tracking runs out of public data. Shielded transfers run on different rules from the transparent records most chains keep. Each one is validated with a zero-knowledge proof, a cryptographic construction that lets the network confirm a transaction is valid without revealing the sender, the recipient or the amount. Zcash supports both public and shielded transactions on the same chain, and its official documentation states that between shielded addresses neither the addresses nor the amounts are disclosed. That design makes the pool's edge the boundary of visibility: transactions entering or leaving Ironwood can leave public traces, so investigators can match entry and exit timing against known amounts, but internal movements inside the pool are not individually observable on public data. The guarantee rests on cryptographic proofs rather than trust in any operator, so there is no server that can be made to hand over the records. The inflow therefore shows the funds' visibility dropped, not that a final recipient or an internal route has been confirmed, and it says nothing on its own about the intent of whoever moved the coins.

Ironwood Arrived With the NU6.3 Upgrade

Bitget's own disclosure frames the breach that set this movement in motion. The exchange said unauthorized transfers hit some of its hot and warm wallets on September 24, 2026, and that attackers gained access to internal systems by compromising a third-party security product. Routing stolen coins through a shielded pool is a downstream step in that incident, and it is a different tracing problem from following an atomic swap, where both legs of a trade sit in plain view on public chains; here the middle of the journey is deliberately invisible. Zcash privacy features of this kind are not new to the protocol: the shielded design traces back to the project's founding generation, whose cryptographic parameters were produced in the closely watched Zcash ceremony, an event that became a reference point for how the community weighed trust in the system's setup. Ironwood itself is new. It is the latest shielded pool introduced by the NU6.3 upgrade, which Zcash activated on July 28, 2026, and the protocol's official guidance describes the upgrade's purpose as independently verifying the integrity of the circulating supply while strengthening protocol security. Nothing in this fund movement indicates that Ironwood or the Zcash network was compromised; the pool behaved as designed, and the boundary trail it leaves is what the design intends to leave behind. Separately, on October 17 an investigator posting as Specter claimed that funds from hacking cases beyond Bitget had also moved into ZEC. That claim came without transaction identifiers or per-case amounts, so it remains unverified against the on-chain record for now. The publicly checkable case so far is the Bitget-linked inflow of 2,746 ZEC, one of the few shielded-pool movements that can be pinned to specific figures because the breach, the upgrade and the inflows all sit on the public record.

The Pool Edge Is the Record

For teams tracking exchange-incident proceeds, the workable method now is time-stamping each crossing at the pool's edge against known amounts, where the Bitget-linked coins left their last public fingerprints. The wider claims stay open until transaction data is published to match them, so the confirmed file here remains a single 2,746 ZEC inflow. ZEC's tape has not treated the development as protocol damage: our live monitoring puts the coin down 6.0% over the past 24 hours, extending a slide that has it 6% below its 7-day average. Macro timing still hangs over the tape, with the October 28 Fed meeting ahead; levels are tracked in our Zcash technical analysis. The sources scope nothing beyond Ironwood itself; the story ends at a pool that worked as designed and now holds coins no one outside can follow.