ZachXBT says Bitget hacker moves $3.8 million into Zcash privacy pool

On-chain investigator ZachXBT said Wednesday that the hacker behind Bitget's $387.5 million theft began moving about 2,700 ZEC, worth roughly $3.8 million, into Zcash's Ironwood shielded pool. On-chain tracking puts the deposit at roughly one-seventh of the ZEC stolen in the hack. Zcash's shielded pool conceals senders, receivers and amounts, although investigators can see coins entering and leaving it. Ironwood launched July 28 to replace the older Orchard pool after a researcher found a bug that could have allowed counterfeit coins. Bitget's systems flagged unauthorized transfers from its hot wallets on September 24. Bitget CEO Gracy Chen said the attackers entered backend systems and faked transaction data rather than stealing private keys. Bitget says its protection fund covers the damage, leaving customer balances unaffected. Chen has said the attack's IP addresses and pattern match North Korean hackers. Blockchain analytics firm Elliptic calls a North Korean link highly likely, although no government has confirmed it. Elliptic ranks the theft as the largest suspected North Korean theft of 2026 and says it pushes this year's total past $1 billion. TRM Labs found that the attacker split funds into new wallets holding roughly 10,000 ETH or 20 million XRP each. Smaller amounts passed through cross-chain swap services including Thorchain, Across, Bridgers, Chainflip and FixedFloat. Near Intents general manager Alex Shevchenko said Tuesday that its SHIELD screening system rejected more than $50 million in swaps tied to the attacker. Shevchenko said about $503,000 was frozen during swaps and roughly $166,000 passed through. Near says the frozen funds will go through legal and recovery proceedings. Near cofounder Illia Polosukhin argued that a permissionless network does not require every application to process every transaction. Chen publicly asked Thorchain to refuse service to the attacker's addresses. Thorchain said a network halt protects the protocol in emergencies and is not a tool for freezing specific funds or swaps. Thorchain's developers say independent node operators vote on halts. Thorchain previously halted its entire network for about five weeks after a $10.7 million exploit on May 15, according to its own report. Thorchain resumed operations on June 22. On-chain data show that several batches totaling roughly 2,390 ETH, or about $6.3 million, were converted into 75.2 BTC through Thorchain on Monday. Bitget is offering a bounty of 5% of any funds frozen and another 5% of any funds recovered, excluding actions ordered by courts or law enforcement.