Suspected North Korea-linked attackers involved in the Bitget exchange hack have begun transferring approximately 2,700 ZEC, valued at about $3.8 million, into Zcash's Ironwood shield pool. On-chain investigator ZachXBT flagged the movement on Sept. 30.
The transfer routes stolen ZEC into a shielding pool—a core Zcash protocol mechanic that obscures transaction details. Once funds enter the pool, tracing subsequent movements becomes significantly harder.
This ZEC transfer represents a portion of the larger 18,900 ZEC, worth roughly $28.3 million, originally stolen from Bitget's hot wallet. The breach occurred Sept. 24 and impacted digital assets totaling approximately $388 million across multiple networks: Ethereum, other EVM chains, the XRP Ledger, Zcash and TRON. Stolen assets included XRP, ETH, USDT, ZEC, USDC, BNB, AVAX and TRX.
Bitget initially reported damage at $351.6 million before revising the figure upward to $387.5 million after investigators identified additional Zcash and TRON transactions tied to the attack.
Bitget CEO Gracy Chen said she is "not very optimistic" about recovering the stolen funds.
ZachXBT's investigation identified five alleged launderers operating under aliases—"jack," "HELP ME," "Melon," "Cc" and "lolo/Marin"—moving the stolen assets. On-chain analysis shows transaction maps connecting these accounts through intermediary wallets directly associated with the Bitget theft, with funds flowing toward decentralized exchanges like THORChain.
One account reportedly sent 277,724 XRP but received only 431 XRP back, citing a duplicate transaction refund—a detail that highlights operational friction within the laundering pipeline.
