Key Takeaways:
Attackers linked to the Bitget exploit have reportedly moved approximately 2,746 ZEC, worth about $3.9 million, into Zcash's Ironwood shielded pool.
This represents roughly 15% of the ZEC stolen in the September 24 breach.
The transfers were first flagged by on-chain investigator ZachXBT.
Ironwood conceals transaction participants and amounts, making the stolen funds significantly harder to trace.
Bitget's CEO has previously said she is "not very optimistic" about fully recovering the stolen funds.
Attackers linked to the September 24 Bitget exploit have begun moving stolen funds into Zcash's shielded transaction system, according to on-chain investigator ZachXBT. Approximately 2,746 ZEC, worth around $3.9 million, were reportedly moved into Zcash's Ironwood shielded pool in three separate transfers between 08:15 and 08:46 UTC on Wednesday.
The Bitget breach involved multiple asset types, with approximately $387.5 million worth of assets transferred to attacker-controlled addresses, according to Bitget's revised estimate. A wallet identified by Bitget as belonging to the attacker received nearly 18,917 ZEC during the September 24 breach, according to CoinDesk's review of transaction records. The three transfers represent about 15% of the ZEC stolen in the September 24 breach.
What Is Ironwood?
Ironwood is Zcash's newest shielded pool, activated on July 28, 2026, as part of the NU6.3 network upgrade. It is designed to keep transaction participants and amounts private from public blockchain observers.
The key privacy feature is straightforward: shielded transactions conceal transaction participants and amounts from public blockchain observers. Investigators can observe funds entering the pool, but once ZEC is shielded, the direct on-chain link between the sender and recipient becomes much harder to establish. If funds are later withdrawn to a transparent public address, the timing, amount and surrounding transaction activity may still provide investigators with clues, even though the direct transaction link is obscured.
Why This Matters for Recovery Efforts
The movement of funds into a shielded pool could complicate Bitget's efforts to trace and recover the assets. Bitget CEO Gracy Chen has said she is "not very optimistic" about fully recovering the stolen funds, pointing to the limited percentage of funds frozen after the 2025 Bybit hack as a reference point.
Funds linked to the attack have also moved through other routes that can make tracing more complex. CoinDesk previously reported that a wallet linked to the Bitget attacker swapped about $6.3 million worth of ether into bitcoin through THORChain. CoinDesk's analysis identified 27 completed swaps involving about 2,390 ETH and 75.2 BTC. Those swaps remained visible on public blockchains because the incoming ether and outgoing bitcoin transactions could be observed. Moving funds into Zcash's shielded pool provides substantially less transaction-level visibility.
The North Korea Connection
Blockchain analytics firm Elliptic assessed the Bitget exploit as highly likely to be linked to the Democratic People's Republic of Korea (DPRK), citing infrastructure overlaps, laundering patterns and connections with previous DPRK-attributed attacks. The assessment remains an attribution by a blockchain analytics firm rather than a publicly confirmed determination by law enforcement.
What Happens Next
The funds entering Ironwood are not necessarily unrecoverable. If the attackers later move the funds to a centralized exchange or another identifiable service, investigators and exchanges may have additional opportunities to trace the funds and, where possible, seek their freezing or recovery.
Bitget has published attacker addresses and a recovery-tracking process, while exchanges, blockchain analytics firms and law enforcement can continue monitoring publicly visible addresses and transaction activity.
Frequently Asked Questions
What is the Ironwood shielded pool?
Ironwood is Zcash's newest shielded pool, activated on July 28, 2026, as part of the NU6.3 network upgrade. It is designed to keep transaction participants and amounts private from public blockchain observers.
How much was moved?
Approximately 2,746 ZEC, worth around $3.9 million, entered Ironwood in three transfers between 08:15 and 08:46 UTC on Wednesday, according to CoinDesk's review of transaction records.
Why does this make funds harder to trace?
Once ZEC enters a shielded pool, the direct public on-chain link between the sender and recipient becomes obscured. Investigators can observe relevant entry and exit activity, but the shielded transactions themselves do not expose the same transaction details available on a transparent address.
Is North Korea behind the attack?
Blockchain analytics firm Elliptic has assessed the exploit as highly likely to be linked to the Democratic People's Republic of Korea (DPRK). That remains an attributed analytical assessment rather than a publicly confirmed law-enforcement determination.
Bottom line: Attackers linked to the Bitget exploit have reportedly moved approximately 2,746 ZEC, worth about $3.9 million, into Zcash's Ironwood shielded pool. The amount represents roughly 15% of the ZEC stolen in the September 24 breach, while the shielded pool makes direct transaction tracing substantially more difficult. The development adds another layer of complexity to efforts to track and potentially recover the assets.
0 Comments