Wallets linked to Bitget’s September 24 security breach moved 2,746 ZEC, worth about $3.9 million at the time, into Zcash’s Ironwood shielded pool on September 30. A review of the transactions found three deposits between 08:15 and 08:46 UTC, representing about 15% of the ZEC stolen during the attack.
The move matters because Zcash shielded transactions conceal the sender, recipient and transferred amount inside the private pool. Investigators can still observe funds entering or later leaving transparent addresses, but the public chain no longer exposes the complete path while value remains shielded.
Bitget’s official incident timeline says the exchange detected unauthorized hot and warm wallet transfers at 18:31 UTC on September 24. The company says attackers exploited a vulnerability in a third-party security product to obtain intranet credentials, forged withdrawal commands and bypassed risk controls. Bitget says private keys were not compromised and its cold wallets were unaffected.
Bitget CEO Gracy Chen discusses the breach, protection fund and withdrawal restoration with The Block on September 28, 2026.
In the interview, CEO Gracy Chen described the incident as a wallet-infrastructure attack rather than a compromise of the exchange’s cold-storage private keys. Bitget initially estimated the affected amount at about $351.6 million, then revised the figure to approximately $387.5 million after adding Zcash and TRON transactions to the accounting.
The privacy angle arrives as Zcash is drawing renewed infrastructure attention. BitcoinVersus recently tracked Cypherpunk’s expanding Zcash mining fleet, while the latest breach shows a separate reason ZEC can matter operationally: its shielded payment layer can reduce the visibility available to investigators following stolen assets.
The initial public alert on X captured the first confirmed loss estimate shortly after Bitget disclosed the incident.
Watcher.Guru reports Bitget’s first public loss estimate after the September 24 breach.
A follow-up post summarized Bitget’s early position that affected funds came from hot-wallet infrastructure, cold wallets remained secure and user balances would be covered by the exchange’s protection fund.
Watcher.Guru summarizes Bitget’s initial hot-wallet, cold-wallet and protection-fund disclosures.
The breach also fits a long-running pattern in which centralized platforms become high-value targets even when the underlying blockchains remain intact. BitcoinVersus previously covered the Indodax exchange hack and the extended restitution process following the 2016 Bitfinex theft.
The Block’s September 25 program covers the Bitget breach during its early market briefing, before the exchange completed its revised loss accounting.
Bitget began phased withdrawals with Bitcoin on September 28, followed by Ethereum networks on September 29 and USDT networks on September 30. The company has said the underlying vulnerability was remediated and that Mandiant and SlowMist joined its investigation and fund-tracing work.
The movement into Ironwood adds a new complication to that recovery effort. Public ledgers are useful for following attacker-controlled balances, but privacy-preserving transactions can break the straightforward visual trail. Funds can still become visible again when they return to transparent addresses or regulated services, so the shielded deposits make tracing harder rather than proving the assets are permanently unreachable.
The larger operational lesson is that custody security depends on more than protecting a signing key. Authentication, internal credentials, withdrawal authorization, monitoring, third-party security software and recovery controls all sit around the key itself. A failure in that surrounding control plane can still produce a nine-figure incident even when cold storage remains untouched.
BitcoinVersus.Tech
Advertisement
BitcoinVersus.Tech advertisement on X.
Editor’s Note
We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support to help further secure the integrity of our research initiatives, please donate here: 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb
BitcoinVersus.tech is not a financial advisor. This media platform reports on financial subjects purely for informational purposes.
Leave a comment