The plot thickens in the aftermath of the $387.5 million Bitget hack. On Wednesday, entities linked to the exploit moved approximately $3.9 million worth of Zcash (ZEC) into the protocol’s private shielded pool, Ironwood. Blockchain investigator ZachXBT spotted the suspicious activity, noting that the funds flowed through two intermediary wallets connected to the original attacker's address, which nabbed nearly 18,917 ZEC during the September 24 breach. By moving these assets into a shielded pool, the bad actors are essentially making the money trail go dark. While Zcash allows for both transparent and private transactions, the shielded layer obscures the sender, recipient, and the specific amounts involved. This move accounts for roughly 15% of the stolen ZEC. Investigators might still be able to play detective using timing and volume patterns, but it is a major L for recovery efforts. Meanwhile, other stolen funds have been traced moving through cross-chain swap services like THORChain, where millions in Ether were converted into Bitcoin. Real talk: this is why on-chain security is no joke. The industry is still reeling from the scale of this heist, and while exchanges are trying to claw back their bags, the hackers are clearly leveling up their evasion tactics. Stay safe out there and remember that keeping your own assets on a hardware wallet is always the play. None of this is financial advice. ## Why it matters Recovering stolen funds is notoriously difficult once they enter privacy-focused protocols. As hackers become more sophisticated with their obfuscation methods, it highlights the ongoing tension between financial privacy and the need for institutional security in the crypto ecosystem.