About $3.9 million of stolen Zcash moved into a shielded pool, while the exchange reports reserves well above customer balances.
As Bitget works through the final stages of restoring customer withdrawals, the attacker behind its recent hack has begun covering tracks.
On , a total of 2,746 Zcash tokens, worth about $3.9 million, moved into Zcash's Ironwood shielded pool in three transfers between 08:15 and 08:46 UTC. Shielded transactions conceal sender, receiver and amount, making the funds far harder to trace once inside.
The transfer represents about 15% of the 18,917 ZEC stolen in the breach.
What the numbers imply
The values give a sense of the scale. At roughly $1,420 per token, implied by the shielded transfer, the full 18,917 ZEC haul would be worth about $27 million. With 15% already shielded, the remaining 85% is still visible on the transparent chain, but the first move suggests the rest may follow.
The exchange's balance sheet
Bitget is trying to reassure customers with its reserves. Its 47th proof-of-reserves report, based on a snapshot taken at 09:00 UTC on , shows total reserves at 131% of customer liabilities. For USDT, the ratio is 107%.
Those figures mean the exchange holds $1.31 in assets for every dollar customers have deposited overall, and $1.07 for every dollar of USDT. The USDT buffer is the thinnest, and it matters most because USDT is where withdrawal demand tends to concentrate after a security incident.
The withdrawal timeline
Bitget has been reopening withdrawals in phases. USDT withdrawals were scheduled to reopen at 08:00 UTC on . The final phase, covering other tokens, fiat currencies and peer-to-peer trading, is due at 08:00 UTC on Friday, .
Why the timing matters
The two events are moving in parallel. As customers regain access to their funds, the attacker is moving stolen assets beyond reach. Recovery of stolen crypto typically depends on freezing funds at exchanges before they are laundered. Every token that enters a shielded pool reduces the chance that any of it will be recovered.
What to watch
Friday's final withdrawal phase is the key test. A smooth reopening, with reserves holding above 100% as customers withdraw, would suggest the exchange has absorbed the hack. Heavy withdrawals that push the USDT ratio toward parity would signal stress. Further movement of the remaining stolen ZEC into the shielded pool would close off recovery.