The attacker behind the theft of $387.5 million from crypto exchange Bitget has begun moving part of the stolen assets into Zcash’s Ironwood shielded pool, according to Decrypt. On-chain investigator ZachXBT said the hacker deposited about 2,700 ZEC, worth roughly $3.8 million, on September 30.
The transfer marks a shift toward a service designed to make cryptocurrency transactions harder to trace. It also follows efforts by crypto infrastructure providers to prevent the attacker from converting the stolen funds into other digital assets.
Why the Zcash transfer matters
Zcash is a privacy-focused blockchain. Its shielded pools encrypt information about a transaction’s sender, recipient and amount. As a result, observers can identify when funds enter or leave the pool, but cannot follow the movement of those funds while they remain inside it.
The attacker’s deposit represents roughly one-seventh of the ZEC taken during the Bitget incident, based on on-chain tracking. The funds were sent to Ironwood, a shielded pool that launched on July 28 and replaced Zcash’s older Orchard pool. Orchard was retired after a researcher identified a bug that could potentially have allowed counterfeit coins to be created.
The move does not mean the entire Bitget haul has entered Zcash. Investigators have also tracked assets through multiple wallets and cross-chain services, which allow users to exchange one cryptocurrency for another across different blockchains. Such movements can make the flow of funds more difficult to reconstruct.
Bitget has valued the theft at $387.5 million. Chief Executive Gracy Chen has said the attack’s internet addresses and activity pattern resemble those associated with North Korean hackers. Blockchain analytics company Elliptic has described a North Korean connection as “highly likely.” No government has publicly confirmed that attribution.
Services take different approaches
The attack began on September 24, when Bitget’s systems detected unauthorized transfers from its hot wallets. These are internet-connected wallets used to hold funds for an exchange’s regular operations. Chen said the attackers accessed backend systems and falsified transaction data rather than taking the exchange’s private keys.
Bitget has said its protection fund will cover the damage, leaving customer balances unaffected. The exchange is nevertheless trying to stop the stolen assets from moving through trading and bridging platforms.
Near Intents said its screening system, SHIELD, rejected more than $50 million in swaps connected to the Bitget attacker. Alex Shevchenko, the platform’s general manager, said about $503,000 was frozen during a swap, while approximately $166,000 passed through. Near said the frozen funds would be handled through legal and recovery proceedings.
The decision renewed debate over the meaning of “permissionless” in crypto. The term generally refers to networks that can be accessed without prior approval. Near co-founder Illia Polosukhin argued that permissionless access does not require every application to process every transaction.
Thorchain adopted a different position after Chen asked it publicly to block addresses linked to the theft. The network said a halt is an emergency measure intended to protect the protocol, rather than a mechanism for selectively freezing particular funds or swaps. Thorchain is operated by independent node operators, which vote on whether to halt the network, rather than by a central company.
Funds continue moving through Thorchain
Thorchain has halted its entire network in the past. According to its own report, the network stopped operating for about five weeks after a $10.7 million exploit on May 15 and resumed on June 22. Its developers said that previous action was a protocol-wide security response, not an address-specific freeze.
Despite the dispute over how to respond to the Bitget theft, the attacker continued using cross-chain services. On Monday, several batches totaling about 2,390 ETH, valued at approximately $6.3 million, were converted into 75.2 BTC through Thorchain, according to on-chain data.
Bitget has offered a bounty equal to 5% of any funds frozen and another 5% of funds recovered. The exchange said the rewards exclude actions carried out under court or law-enforcement orders.
The competing responses highlight a central difficulty in tracing stolen crypto: decentralized infrastructure can allow assets to move without a single operator having authority over every transaction, while individual services may still use screening systems or other controls. The Zcash deposit adds another layer of complexity because the public blockchain records the entry and exit of funds but conceals activity inside the shielded pool.
Current market picture
Moneyiar market data at 9:28-9:29 a.m. on October 1, 2026, put Zcash at $1,413.4109555313, up 0.42% over 24 hours but down 5.23% over seven days. NEAR Protocol was trading at $5.2331192467, up 3.25% in 24 hours and 25.71% over seven days.
Loaded Lions stood at $0.0015460131, with a 24-hour gain of 1.86% and a seven-day gain of 4.69%. Ronin was priced at $0.0645728738, down 0.22% over 24 hours and up 12.33% over seven days.
