Cryptocurrency: Bitget hackers switch strategies after the NEAR incident

Hackers change tactics: Bitget stolen funds turn to Zcash privacy pool

Hackers linked to the Bitget crypto-asset theft are adjusting their money laundering strategies. After a failed attempt to clean more than $50 million through the NEAR Intentions platform, they injected approximately 2,746 ZECs (worth nearly $3.9 million) into Zcash's protected Ironwood pool. Once funds enter the system, the difficulty of tracking will increase significantly.

Core Points

• About US$3.9 million in ZEC was transferred to the protected Ironwood Pool.
• NEAR Intentions claims to have intercepted exchange transactions worth more than US$50 million related to the hack.
• It is currently estimated that the amount stolen from Bitget is approximately US$387.5 million.

Zcash becomes new money transfer channel

In just three transactions, approximately 2,746 ZECs were sent to Ironwood-a protected Zcash pool. This represents approximately 15% of the total of 18,917 ZECs stolen at the time of the Bitget attack. The operation took place a few days after the Bitget hack, whose total damage is now estimated at $387.5 million.

Zcash allows confidential cryptocurrency transactions where the sender, receiver and amount can be hidden. While the funds deposited into Ironwood remain visible on the blockchain, subsequent flows within the pool are extremely difficult to correlate with the original funds.

这并不意味着资产完全无法找回。调查人员仍可通过分析时间戳、金额或流向公共地址的未来输出数据进行追踪。然而，追踪链条变得不再顺畅。这也部分解释了为何Zcash在注重隐私的加密货币中仍占据重要地位。对于追踪Bitget资金的调查人员而言，这种路线的转变增加了额外的挑战层级。

超5000万美元尝试受阻，转而使用Zcash

在使用Zcash之前，黑客曾尝试其他路径。NEAR Intents声称已拒绝处理与Bitget黑客攻击相关地址联系的、价值超过5000万美元的兑换请求。该加密协议采用了过滤机制，旨在货币转换前识别可疑资金。因此，大部分尝试以失败告终。

资金也曾流经THORChain网络。在该网络上，情况有所不同：Bitget曾公开要求屏蔽与盗窃相关的地址，但THORChain并未停止其活动。由于该协议没有能够直接冻结地址的中心化权威机构，导致监管失效。

这一系列事件主要展示了加密货币窃贼更换作案工具的迅速程度：一条路走不通，便测试另一条。Zcash恰好提供了监控平台在此类案件中极力避免的功能：即切断资金入口与出口之间的部分公开链接。

It should be emphasized that the network was not designed for hackers. Its privacy feature is available to any encrypted user who wants to avoid public display of all payment records. However, when the technology encounters stolen assets, management difficulties do increase significantly.

Bitget needs to cope with more difficult to track capital flows

After several days of suspension, Bitget has gradually resumed its coin withdrawal service. Bitcoin was restored first, followed by Ethereum and USDT, and other services will also be restored in phases. The exchange stated that customer balances remained complete.

The current focus has shifted to financial recovery. According to Bitget, the September 24 incident did not involve security breaches in private keys or cold wallets. According to reports, the attacker used a vulnerability in a third-party security product to obtain high-level internal credentials and sent false withdrawal instructions.

The total loss rose to approximately $387.5 million as additional transactions were discovered on the Zcash and Tron networks. With the support of industry partners, investigators have successfully frozen some funds. Mandiant, SlowMist, multiple crypto exchanges and on-chain analysis experts are also working together on asset tracking and suspicious movement monitoring.

However, Ironwood changed the nature of the work. A typical cryptocurrency transaction leaves a clear trajectory between two public addresses, while a protected Zcash transaction cuts off the connection. In fact, this mechanism has once again attracted market attention. Recently, Zcash and Monero have pushed the market value of privacy coins to rise significantly. In the Bitget case, approximately $3.9 million has gone down this route. Although this is only a small fraction of the $387.5 million stolen, it is enough for investigators to seriously complicate tracking leads.