Hackers behind Bitget’s $387.5 million breach are turning to Zcash's privacy features to hide the stolen funds as crypto firms increasingly block other escape routes.

About 2,746 ZEC worth roughly $3.9 million was transferred Wednesday into Zcash’s Ironwood shielded pool through three transactions, according to on-chain activity flagged by blockchain investigator ZachXBT . The amount represents about 15% of the 18,917 ZEC stolen from the exchange.

The transfers complicate Bitget’s recovery effort because transactions inside Ironwood can conceal senders, recipients, and amounts, breaking the public transaction trail investigators use to follow stolen assets. Deposits into the pool remain visible, but subsequent movements become considerably harder to link to their origin.

The shift toward Zcash's privacy infrastructure follows attempts by the attackers to move substantially larger sums through cross-chain services, some of which have begun refusing the transactions.

NEAR Intents General Manager Alex Shevchenko said wallets connected to the Bitget theft attempted to process more than $50 million through the protocol. Its SHIELD risk system rejected most of those transactions before execution, while roughly $503,000 was frozen after swaps had begun and about $166,000 successfully passed through.

The rejected assets remained under the attackers’ control, leaving them free to seek alternative routes. The latest Zcash transfers show how that contest is shifting as stolen funds encounter tighter screening across parts of the crypto market.

One alternative has been THORChain, the permissionless cross-chain exchange that has resisted Bitget’s requests to block addresses linked to the theft.

Bitget-linked wallets have repeatedly used the protocol to turn stolen assets into native Bitcoin. Bitquery estimated that about 29,088 ETH, worth roughly $79 million at the time of its analysis, had been sent into THORChain and swapped for Bitcoin through Sept. 29.