Hackers responsible for the $387.5 million breach of cryptocurrency exchange Bitget have turned to privacy coin Zcash, transferring 2,746 ZEC worth approximately $3.9 million into its Ironwood shielded pool. The movement follows successful interventions by cross-chain security protocols that blocked over $50 million in attempted laundering trades.
- Zcash Shielded Transfers: Attackers routed 15% of the 18,917 ZEC stolen in the breach into Zcash's Ironwood pool across three transactions, according to on-chain data flagged by ZachXBT.
- NEAR Intents Blockade: NEAR Intents' SHIELD risk system rejected the majority of $50 million in attempted transactions, freezing $503,000 and allowing only $166,000 to pass through.
- THORChain Volume Surge: The permissionless protocol declined Bitget's requests to blacklist hacker addresses, facilitating swaps of 29,088 ETH (around $79 million) into native Bitcoin and driving DEX volume past $1.5 billion.
- Bitget Outflows: Customers withdrew over $700 million following a four-day withdrawal freeze, including 9,585 requests totaling 4,098 BTC on Sept. 28.
Cross-Chain Roadblocks Push Attackers Toward Privacy Pools
The shift toward Zcash's privacy infrastructure occurred after the attackers encountered tight screening across cross-chain services. According to Alex Shevchenko, General Manager of NEAR Intents, wallets tied to the theft attempted to process more than $50 million through the protocol. Its SHIELD risk engine rejected most of those transactions before execution, freezing roughly $503,000 mid-swap while $166,000 successfully traversed the network.
In contrast, the attackers found an open path through THORChain, which maintained its policy against selective censorship and declined Bitget's requests to freeze flagged wallets. According to Bitquery, about 29,088 ETH (valued at $79 million at the time of analysis) was transferred into THORChain and swapped for native Bitcoin through Sept. 29. Data from DeFiLlama revealed that THORChain processed over $1.5 billion in DEX volume following the incident, up from $146 million during the week preceding the breach.
Bitget Rebuilds Reserves Amid $700 Million Outflow Rush
While monitoring funds, Bitget has been managing heavy customer withdrawals after ending its four-day transaction freeze. On-chain tracking from DeFiLlama shows over $700 million moved out of recognized Bitget wallets once channels reopened. On Sept. 28, hours after restoring Bitcoin transactions, Bitget reported processing 9,585 withdrawal requests totaling 4,098 BTC.
Access has expanded incrementally across Ethereum and USDT across Ethereum, BNB Chain, Solana, and Tron, with remaining cryptocurrencies, fiat, and peer-to-peer services scheduled to reopen on Friday. On Sept. 30, Bitget Chief Executive Officer Gracy Chen confirmed that the exchange's Protection Fund was restored to over $300 million, mirroring proactive reserve measures seen when MEXC deposited 1,000 BTC into its Guardian Fund. Bitget's proof-of-reserves snapshot on Sept. 29 showed a 131% reserve ratio across 19 covered assets, representing a 31% buffer over customer liabilities.
Why It Matters
The contrasting actions of NEAR Intents and THORChain highlight an escalating ideological split within decentralized finance between regulatory compliance and strict permissionless neutrality. While risk filters like SHIELD prove effective at stopping large-scale illicit capital flows on certain platforms, privacy pools and censorship-resistant DEXs continue to serve as secondary escape routes for stolen assets. How centralized venues withstand post-exploit bank runs while restoring consumer confidence will likely define operational benchmarks for exchange risk management moving forward.
