Around $3.9 million worth of zcash (ZEC) linked to the $387.5 million Bitget hack has been moved into Zcash’s shielded payment system, making the funds more difficult to track.

CoinDesk’s review of blockchain data showed that 2,746 ZEC entered Ironwood, Zcash’s newest shielded pool, through three transactions between 08:15 and 08:46 UTC Wednesday.

Pseudonymous blockchain investigator ZachXBT initially flagged the transfers. He said the funds were routed through two intermediary addresses that had been funded by a wallet Bitget identified as controlled by the attacker. That wallet received almost 18,917 ZEC during the Sept. 24 breach.

Zcash provides both transparent and private transaction options. Although the amount transferred into Ironwood remains visible, transactions within the shielded pool conceal the identities of senders and recipients and the amounts involved.

If the ZEC is later sent from the shielded pool to a transparent address, the amount withdrawn can be seen publicly. Investigators may then analyze deposit and withdrawal times, amounts and other metadata for potential links. However, the Zcash network does not reveal a direct transaction trail connecting an individual deposit with a particular withdrawal.

The three Ironwood transactions account for roughly 15% of the ZEC stolen in the Bitget attack.

Other stolen assets have also been routed through cross-chain swap services. CoinDesk previously traced about $6.3 million worth of ether converted into bitcoin through THORChain from an address linked to the attacker.

Those transactions left public records showing the ether entering the service and bitcoin exiting it, providing a more visible trail than funds moved through Zcash’s shielded pool.