Bitget hacker moves $3.9 million of stolen funds into Zcash pool

What happened

The hacker behind the Bitget breach has started hiding part of the haul inside Zcash's private pool. On-chain investigator ZachXBT said Wednesday that the attacker began moving about 2,700 ZEC, roughly $3.8 million, into Ironwood, a shielded pool on the Zcash network. The breach began on Sept. 24, when Bitget flagged unauthorized transfers out of its hot wallets.

CoinDesk reviewed records showing the deposits went through three sequential operations, with the timeframe running from 08:15 through 08:46 UTC. The transfers totaled 2,746 ZEC, an amount that accounts for about 15% of the ZEC compromised in the incident. Blockonomi puts the value at roughly $3.9 million.

According to ZachXBT, the coins flowed through two intermediary addresses before reaching the shielded pool. Those addresses were funded by a wallet Bitget has identified as attacker-controlled, and that wallet received approximately 18,917 ZEC during the September 24 breach.

Why it matters

A shielded pool encrypts the sender, the receiver and the amount, so nobody can follow the money once it goes in. External observers can detect deposits entering the privacy pool, but internal activity remains invisible. As of Wednesday, no new movements out of the Ironwood pool had been reported.

Bitget is still working to recover assets, and wallet analysts treat shielded pools as a common step attackers take to slow or block that process. Bitget CEO Gracy Chen has said the attack's IP addresses and pattern match North Korean hackers, and Elliptic calls a North Korean link highly likely. Elliptic also ranks it the largest suspected North Korean theft of 2026, pushing the year's total past $1 billion.

Bitget says its protection fund covers the damage, so customer balances are unaffected.

What the data shows

Bitget lost $387.5 million in the hack. Roughly $3.9 million in Zcash value entered Ironwood, in transfers totaling 2,746 ZEC, which is approximately 15% of the ZEC compromised in the incident.

Near Intents said its SHIELD screening system rejected more than $50 million in swaps tied to the attacker. General manager Alex Shevchenko said about $503,000 got frozen mid-swap and roughly $166,000 slipped through.

In an earlier case, about $6.3 million in ether was swapped for bitcoin. TRM Labs found the attacker split funds into fresh wallets holding round amounts, roughly 10,000 ETH or 20 million XRP each.

Background

Ironwood launched July 28 to replace an older pool, Orchard, after a researcher found a bug that could have let someone print counterfeit coins.

THORChain has halted before: it stopped its entire network for about five weeks after a $10.7 million exploit on May 15, according to its own report, and resumed June 22. After Chen publicly asked it to refuse service to the attacker's addresses, the project said a network halt is an emergency tool to protect the protocol, not a way to freeze specific funds or swaps.

What is still unclear

• It is not clear when or how much of the ZEC inside Ironwood will leave the pool. Outbound movements to transparent addresses would become publicly traceable again.
• The recent shielded deposits constitute just a fraction of the attacker's total ZEC holdings.

Questions readers ask