Bitget Hacker Moves $3.8 Million in Stolen Crypto to Zcash Privacy Pool

The hacker who drained $387.5 million from crypto exchange Bitget has started hiding some of the loot inside Zcash's private pool. On-chain investigator ZachXBT said Wednesday that the attacker began moving about 2,700 ZEC—roughly $3.8 million—into Ironwood, a shielded pool on the privacy-focused Zcash blockchain.

A shielded pool is a part of the Zcash network that encrypts the sender, the receiver, and the amount, so nobody can follow the money once it goes in. Ironwood launched July 28 to replace an older pool, Orchard, after a researcher found a bug that could have let someone print counterfeit coins.

The deposit is roughly one-seventh of the ZEC stolen in the hack, according to on-chain tracking. Investigators can still see coins go into the pool and come out, but not what happens in between.

Bitget CEO Gracy Chen has said the attack's IP addresses and pattern match North Korean hackers, and blockchain analytics firm Elliptic calls a North Korean link "highly likely." Elliptic also ranks it the largest suspected North Korean theft of 2026, pushing the year's total past $1 billion.

How the money got here

The heist began Sept. 24, when Bitget's systems flagged unauthorized transfers out of its hot wallets—the internet-connected wallets that hold an exchange's day-to-day funds. Chen said the attackers got into backend systems and faked transaction data rather than stealing private keys. Bitget says its protection fund covers the damage, so customer balances are unaffected.

Then came the laundering. TRM Labs found the attacker split the funds into fresh wallets holding round amounts, roughly 10,000 ETH or 20 million XRP each. Smaller chunks went through cross-chain swap services—tools that trade one coin for another on a different blockchain, which muddies the trail—including Thorchain, Across, Bridgers, Chainflip, and FixedFloat.

Near Intents, meanwhile, said no. General manager Alex Shevchenko said Tuesday that its screening system, called SHIELD, rejected more than $50 million in swaps tied to the Bitget attacker. About $503,000 got frozen mid-swap, and roughly $166,000 slipped through, he said.

Near says the frozen funds will go through legal and recovery proceedings. The move set off a familiar crypto fight over the word "permissionless," which means anyone can use a network without approval. Near cofounder Illia Polosukhin argued that it doesn't oblige every app to process every transaction.

Thorchain went the other way. After Chen publicly asked it to refuse service to the attacker's addresses, Thorchain said in a post on X that a network halt is an emergency tool to protect the protocol, not a way to freeze specific funds or swaps. It is run by independent node operators who vote on halts, not by a company, according to its developers.

The obvious objection is that Thorchain has stopped transactions before. It halted its entire network for about five weeks after a $10.7 million exploit on May 15, according to its own report, and resumed June 22.

The hacker’s swaps kept flowing in the meantime. On Monday, several batches totalling roughly 2,390 ETH—about $6.3 million—were converted into 75.2 BTC through Thorchain, on-chain data show.