Bitget's North Korean suspect hops into Zcash's bunker with $3.9M of stolen ZEC 🛡️

Wallets tied to the Sept. 24 hack of crypto exchange Bitget moved roughly $3.9 million in zcash into Zcash's Ironwood shielded pool on Wednesday, obscuring a slice of the $387.5 million heist as investigators continue to track the funds. Blockchain records reviewed by CoinDesk show 2,746 ZEC entered the privacy pool in three transfers between 08:15 and 08:46 UTC, representing about 15% of the ZEC stolen in the breach. Pseudonymous investigator ZachXBT first flagged the movements earlier in the day. The funds passed through two intermediary addresses funded by a wallet Bitget identified as belonging to the attacker, which received nearly 18,917 ZEC during the incident.

Ironwood, which launched July 28 to replace the older Orchard pool after a researcher discovered a counterfeiting bug, encrypts the sender, recipient and amount of any payment inside it. Observers can see the value crossing into and out of the pool, but cannot link those entry and exit points to one another, leaving timing and metadata as the main tools for following the money. The Zcash deposits add to a laundering effort that has already pushed about $6.3 million in ether-to-bitcoin swaps through THORChain from one attacker-linked wallet, transactions that left a public trail of incoming ETH and outgoing BTC.

Bitget CEO Gracy Chen has said the attack's IP addresses and behavioral pattern match North Korean hackers, and blockchain analytics firm Elliptic rates a North Korean connection as "highly likely." Elliptic also ranks the heist the largest suspected North Korean theft of 2026, pushing the year's alleged total past $1 billion. TRM Labs found the attacker split proceeds into fresh wallets holding round amounts of roughly 10,000 ETH or 20 million XRP, with smaller portions routed through cross-chain swap services including Thorchain, Across, Bridgers, Chainflip and FixedFloat. Near Intents took the opposite stance, with general manager Alex Shevchenko saying Tuesday that its SHIELD screening system rejected more than $50 million in swaps tied to the Bitget attacker, froze about $503,000 mid-swap and let roughly $166,000 slip through.

THORChain declined Bitget's request to block the attacker, with its developers posting on X that "a THORChain network halt is an emergency security mechanism designed to protect the protocol" and that "a halt is not a selective freeze of specific funds or an individual swap," noting that such pauses are decided by independent node operators. Near cofounder Illia Polosukhin pushed back on the idea that permissionless networks must process every transaction, a dispute that has reignited a familiar debate over what "permissionless" really means in practice. Bitget says its protection fund covers the damage and that customer balances are unaffected.