Bitget hackers move $3.8 million into Zcash privacy pool
Attackers behind the $387.5 million Bitget breach have begun laundering stolen Zcash through the Ironwood shielded pool after facing roadblocks on cross-chain routing services.
Attackers tied to the $387.5 million Bitget exploit have begun transferring stolen Zcash into Zcash's Ironwood shielded pool, according to on-chain investigator ZachXBT. ZachXBT reported that the attackers, whom he alleged are linked to North Korea, moved roughly 2,746 ZEC valued between $3.8 million and $3.9 million across three transactions. Deposits into Ironwood conceal the sender, recipient, and transaction amount, breaking the public trail investigators rely on to trace stolen assets.[1][3][4][5][7]
The shielded funds account for approximately 15% of the roughly 18,900 ZEC, worth about $28.3 million, stolen during the Sept. 24, 2026 breach. The turn toward Zcash privacy pools occurred after the perpetrators met friction elsewhere. Wallets tied to the theft attempted to swap more than $50 million through NEAR Intents, but its risk system blocked most transactions, freezing about $503,000 while allowing only $166,000 through. However, the attackers successfully routed roughly 29,088 ETH worth $79 million through THORChain to swap into Bitcoin after the decentralized exchange declined Bitget's requests to block their addresses.[1][2][5][6]
Meanwhile, Bitget is navigating heavy customer outflows after gradually lifting a four-day withdrawal freeze. DeFiLlama data indicates that over $700 million has left tracked exchange wallets. Bitget CEO Gracy Chen announced that the exchange's Protection Fund had been restored to over $300 million and cited a 131% reserve ratio across covered assets, although she previously remarked that she was not very optimistic about recovering the stolen funds.[3][5]
Key facts
- ZachXBT reported that alleged North Korean attackers began shielding approximately 2,746 ZEC ($3.8 million to $3.9 million) from the Bitget exploit into Zcash's Ironwood pool.
- The transfers represent roughly 15% of the approximately 18,900 ZEC ($28.3 million) stolen from Bitget on Sept. 24, 2026.
- Ironwood pool transfers conceal senders, recipients, and amounts, significantly hindering recovery and tracing efforts.
- NEAR Intents rejected most of an attempted $50 million swap from hacker-linked wallets and froze roughly $503,000, prompting the shift to other avenues.
- THORChain resisted requests to censor hacker wallets, facilitating swaps of roughly 29,088 ETH ($79 million) into native Bitcoin.
- More than $700 million has been withdrawn from tracked Bitget wallets since the exchange reopened withdrawal channels.
- Bitget CEO Gracy Chen reported that the Protection Fund was restored to over $300 million with a 131% reserve ratio, though she noted low optimism for asset recovery.
Sources · 7 sources
- CO
CoindeskArticle ·
Bitget hackers move $4 million into Zcash’s private pool, making funds harder to trace Three transfers pushed about 15% of the stolen ZEC into Ironwood, where payments hide their senders, recipients and amounts.
Open source - DE
DecryptArticle ·
Bitget Hacker Turns to Zcash Privacy Pool After Near Rejects $50M in Swaps The attacker behind the $387.5 million Bitget heist has started hiding about $3.8 million in ZEC inside Zcash's Ironwood pool, after Near Intents turned their swaps away.
Open source - CB
Coin Bureau@coinbureauPost on X ·
🚨BREAKING: ZachXBT says alleged DPRK attackers are now shielding stolen Bitget funds through Zcash. Around 2,700 $ZEC, worth $3.8M, has reportedly started moving into Zcash’s Ironwood. This means the stolen ZEC is now being pushed into a shielded pool, where transaction details can be hidden and tracing becomes much harder. Roughly 18,900 ZEC, worth $28.3M, was stolen from Bitget’s wider $388M breach across multiple assets. Earlier, Bitget CEO Gracy Chen says she is “not very optimistic” about recovering the stolen funds.
Open source - DN
DEGEN NEWS@DegenerateNewsPost on X ·
NEW: @zachxbt SAYS "THE ALLEGED DPRK ATTACKERS HAVE JUST BEGUN SHIELDING ~2.7K ZEC ($3.8M) TOTAL FROM THE BITGET EXPLOIT INTO THE IRONWOOD POOL" SOURCE: https://t.co/7wmMHwdOB7 https://t.co/yE7dYqnsLy
Open source - CR
CryptoSlateArticle ·
Bitget’s hackers turn to Zcash after $50 million laundering route gets blocked Hackers behind Bitget’s $387.5 million breach are turning to Zcash's privacy features to hide the stolen funds as crypto firms increasingly block other escape routes. About 2,746 ZEC worth roughly $3.9 million was transferred Wednesday into Zcash’s Ironwood shielded pool through three transactions, according to on-chain activity flagged by blockchain investigator ZachXBT . The amount represents about 15% of the 18,917 ZEC stolen from the exchange. Bitget Attackers Fund Movement into Zcash's Shielded Pool (Source: ZachXBT) The transfers complicate Bitget’s recovery effort because transactions inside Ironwood can conceal senders, recipients, and amounts, breaking the public transaction trail investigators use to follow stolen assets. Deposits into the pool remain visible, but subsequent movements become considerably harder to link to their origin. The shift toward Zcash's privacy infrastructure follows attempts by the attackers to move substantially larger sums through cross-chain services, some of which have begun refusing the transactions. NEAR Intents General Manager Alex Shevchenko said wallets connected to the Bitget theft attempted to process more than $50 million through the protocol. Its SHIELD risk system rejected most of those transactions before execution, while roughly $503,000 was frozen after swaps had begun and about $166,000 successfully passed through. The rejected assets remained under the attackers’ control, leaving them free to seek alternative routes. The latest Zcash transfers show how that contest is shifting as stolen funds encounter tighter screening across parts of the crypto market. THORChain volume surges as hackers seek other routes One alternative has been THORChain, the permissionless cross-chain exchange that has resisted Bitget’s requests to block addresses linked to the theft. Bitget-linked wallets have repeatedly used the protocol to turn stolen assets into native Bitcoin. Bitquery estimated that about 29,088 ETH, worth roughly $79 million at the time of its analysis, had been sent into THORChain and swapped for Bitcoin through Sept. 29. As a result, activity on the decentralized exchange has exploded since the breach. THORChain has processed more than $1.5 billion in DEX volume in the days following the incident, compared with roughly $146 million during the week before the attack, according to DeFiLlama data reviewed by CryptoSlate . The increase has coincided with hacker-linked flows, although total THORChain volume cannot be attributed to the attackers. THORChain's actions, in contrast to NEAR, highlight a widening divide over how decentralized infrastructure should respond when it identifies stolen assets. NEAR has argued that permissionless access does not require its liquidity providers to execute known illicit transactions. However, THORChain has maintained that selective censorship would undermine the principles governing its network. That disagreement has practical consequences for Bitget. Blocking one venue does not freeze assets held in self-custodied wallets. Instead, it forces the attacker to find another source of liquidity, potentially pushing funds toward permissionless exchanges or privacy systems that offer investigators fewer opportunities to intervene. Bitget absorbs withdrawal rush as operations restart Meanwhile, Bitget is facing a separate test from its customers as it gradually restores access to funds following the four-day withdrawal freeze. DeFiLlama data reviewed by CryptoSlate shows more than $700 million has moved out of tracked Bitget wallets since withdrawal channels began reopening, highlighting immediate customer demand to move assets off the exchange. DeFiLlama tracks known exchange wallets, meaning the figure reflects on-chain flows rather than Bitget’s complete internal withdrawal ledger. Bitcoin accounted for a sizable portion of the initial rush. Bitget said it had processed 9,585 withdrawal requests totaling 4,098 BTC by Sept. 28, hours after reopening Bitcoin withdrawals. The outflows have continued as the exchange progressively restored other assets. Bitcoin withdrawals reopened Sunday, followed by Ethereum and then USDT across Ethereum, BNB Chain, Solana and Tron. Bitget plans to reopen withdrawals for its remaining cryptocurrencies as well as fiat and peer-to-peer services on Friday. On Sept. 30, Bitget's Chief Executive Officer Gracy Chen said that the exchange's Protection Fund had also been rebuilt to more than $300 million, restoring a threshold the company had promised to reach after drawing on the fund following the breach. She said BTC, ETH and USDT withdrawals were already operating and described the business as “gradually back to usual.” The exchange’s latest proof-of-reserves snapshot provides another measure of its ability to withstand the withdrawals. Bitget reported an overall reserve ratio of 131% across 19 covered assets as of Sept. 29, meaning the assets included in its disclosure exceeded corresponding customer balances by 31%. Those figures will face a broader stress test when Bitget removes the remaining withdrawal restrictions Friday. The post Bitget’s hackers turn to Zcash after $50 million laundering route gets blocked appeared first on CryptoSlate .
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
Attackers in Bitget Exploit Begin Transferring Approximately 2,700 ZEC to Ironwood Shielded Pool According to ZachXBT, attackers allegedly linked to North Korea in the Bitget exploit have begun transferring approximately 2,700 ZEC, worth around $3.8 million, into Zcash’s Ironwood shielded pool. On September 24, 2026, approximately 18,900 ZEC, worth around $28.3 million, was stolen from Bitget.
Open source - CB
Crypto Briefing@Crypto_BriefingPost on X ·
🔒NEW: Wallets linked to Bitget’s $387.5M hack moved about $3.9M in ZEC into Zcash’s Ironwood shielded pool. The transfers, totaling 2,746 ZEC, were first flagged by blockchain investigator ZachXBT on his Telegram channel. https://t.co/2RZBpnLBy8
Open source