TLDR
- Wallets linked to the Bitget hack moved about $3.9 million in Zcash into a private payment pool called Ironwood.
- Three transfers totaling 2,746 ZEC happened between 08:15 and 08:46 UTC on Wednesday.
- The shielded pool hides the sender, recipient and amount of transactions inside it.
- The move covers about 15% of the total ZEC stolen in the Sept. 24 Bitget breach.
- Other stolen funds were previously traced through THORChain in ether-to-bitcoin swaps worth about $6.3 million.
Hackers behind the Bitget breach have moved a portion of their stolen funds into a private payment system, making the money harder to track. The wallets involved are linked to a hack that drained $387.5 million from the exchange.
🚨BREAKING: ZachXBT says alleged DPRK attackers are now shielding stolen Bitget funds through Zcash.
Around 2,700 $ZEC, worth $3.8M, has reportedly started moving into Zcash’s Ironwood.
This means the stolen ZEC is now being pushed into a shielded pool, where transaction… pic.twitter.com/sFI8WSL5i7
— Coin Bureau (@coinbureau) September 30, 2026
On Wednesday, about $3.9 million worth of Zcash entered a shielded pool called Ironwood. This is the newest privacy feature on the Zcash network.
CoinDesk reviewed transaction records showing the transfers happened in three parts. They took place between 08:15 and 08:46 UTC.
In total, 2,746 ZEC moved into the pool. That amount is about 15% of all the ZEC stolen during the breach.
How the Zcash Shielded Pool Works
Zcash lets users send money in two ways. One is public, where anyone can see the transaction. The other is private, using a shielded pool like Ironwood.
Once funds enter the shielded pool, the details disappear from public view. The sender, the recipient, and the exact amount all become hidden.
Outside observers can still see money entering the pool. They just cannot see what happens once it is inside.
If the funds later leave the pool and move to a public address, that transaction becomes visible again. At that point, investigators can try to match up clues.
They look at things like timing and transaction size. This can help connect money leaving the pool to money that entered it earlier, though it is not a guaranteed match.
Who Found the Transfers
Blockchain investigator ZachXBT first spotted the movements on Wednesday. He is known for tracking crypto hacks and following stolen funds across different wallets.
According to ZachXBT, the money passed through two go-between addresses first. Those addresses were funded by a wallet that Bitget has identified as belonging to the attacker.
That same wallet received close to 18,917 ZEC when the hack happened on Sept. 24. The recent shielded pool deposits represent only part of that total.
Bitget is still working to recover the stolen assets. Moving funds into a shielded pool is a common step attackers take to slow down or block that recovery process.
This is not the first time hackers linked to this breach have tried to hide their tracks. CoinDesk has also traced other transfers connected to the same attacker wallets.
In an earlier case, about $6.3 million in ether was swapped for bitcoin. Those swaps went through a service called THORChain.
Unlike the Zcash shielded pool, those THORChain transactions left a visible record. Investigators could see the ether going in and the bitcoin coming out.
The difference highlights why the Zcash pool is a bigger obstacle for trackers. It removes visibility entirely while funds sit inside it.
As of Wednesday, no new movements out of the Ironwood pool had been reported. The stolen funds remain split across different tracking methods, some visible and some hidden.
