Invest2 publishers3 min readPublished
Bitget's hackers push $3.9 million of stolen ZEC into Zcash's untraceable Ironwood pool
Wallets tied to the $387.5 million Bitget hack moved 2,746 ZEC, about $3.9 million, into Zcash's Ironwood shielded pool on September 30. The deposit is about 1% of the theft, and across every route tracked so far roughly 13 dollars have gone dark for each dollar frozen.
The Investor · Invest desk
What happened
- The coins went in across three deposits between 08:15 and 08:46 UTC, via two intermediary addresses funded by a wallet Bitget had already flagged.
- On-chain investigator ZachXBT first spotted the deposit, which Cryptopolitan puts at roughly 15% of the ZEC the attackers stole.
- A further $6.3 million has gone dark through Ether-to-Bitcoin swaps processed on THORChain.
- An attempt to push more than $50 million through NEAR Intents' SHIELD system failed when the protocol froze $503,000, though about $166,000 got through.
- Grayscale's Zcash ETF, ZCSH, completed a 3-for-1 forward share split before the market opened the same day.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- constraint Inside Ironwood, investigators lose the direct link between what went in and what comes out, so tracing the 2,746 ZEC now depends on inference from timing, values and metadata.
- cost Holding its user protection fund at $309 million, a sum equal to about 80% of the theft, ties up capital Bitget cannot put to other use while the stolen funds move.
- exposure ZCSH holders now own a token whose newest privacy pool has a dated laundering use by wallets linked to suspected North Korean operators, nine weeks after that pool went live.
Divide $3.9 million by 2,746 coins and the hackers were shielding ZEC at about $1,420 a coin [1]. Cryptopolitan reports that the deposit is 15% of the Zcash taken [6]. On that figure, the ZEC slice of the theft was about 18,300 coins, or roughly $26 million [2]. That is under 7% of a $387.5 million haul [3].
The laundering that has worked so far is also small next to the headline figure. The shielded deposit, the $6.3 million swapped from Ether to Bitcoin on THORChain [8] and the roughly $166,000 that got through NEAR Intents [9] add up to about $10.4 million out of sight [5]. Against that, NEAR Intents froze $503,000 [9] and Circle and Tether froze $318,013 [10], about $821,000 in all [6]. Divide the first sum by the second and the hackers are ahead by about 12.6 to 1 [7]. The two sums together come to under 3% of what was stolen [8].
Every frozen dollar sat with a party able to act on it. In one case that was the protocol behind NEAR Intents' SHIELD system, and in the other the two stablecoin issuers [9][10]. The $10.2 million routed through THORChain and Ironwood went dark [9].
The ETF and the deposit fall on the same date. Grayscale's ZCSH became the first US ETF with spot ZEC exposure when it listed on NYSE Arca on August 25 [11]. Its 3-for-1 split took effect before the open on September 30, turning each share into three, each worth about a third of the old net asset value [12]. Cryptopolitan calls it "a rare intersection between Wall Street buyers and North Korea-linked launderers" [16]. The account does not report fund flows, a regulator's response or any comment from Grayscale.
From here the money can go three ways. If the hackers keep feeding ZEC into Ironwood, Zcash's documented laundering case grows while a listed fund holds the token. They could lean on THORChain instead, since it has already carried more than the shielded pool [8][1]. Or the Chinese intermediaries could fail to find the help they were after. ZachXBT said the Chinese actors moving money for the alleged DPRK attackers were "openly asking for support" in Discord servers and Telegram channels on September 28 [13].
I think the reputational charge against the ETF runs ahead of this evidence. More of the money that cleared went through THORChain than through Zcash's pool [8][1]. The split also changed share counts and left the value of holdings where it was [12]. The counter-case is that size does not matter to a regulator. On that view, wallets Cryptopolitan ties to suspected North Korean operators using Zcash's newest pool is something a regulator can cite whatever the amount [2]. ZCSH outflows, or a regulator naming Zcash, in the weeks after September 30 would prove this view wrong.
Cryptopolitan calls the theft the largest hit of 2026 to date [3]. Bitget has since refilled its user protection fund to $309 million, about 3,705 bitcoin [14]. The report puts that at 131% above the exchange's $300 million commitment [14]. The two figures put it about 3% above [11].
What to watch
- Bitget's October 2 reopening of fiat, peer-to-peer and its remaining assets, and whether the protection fund is still reported at $309 million afterward.
- Any exit from Ironwood to a public Zcash address in amounts or timing that line up with the three September 30 deposits.
- Further freezes by NEAR Intents, Circle or Tether as the rest of the $387.5 million moves.