Bitget hackers move $3.9 million into Zcash shielded pool

Following a massive $387.5 million zero-day exploit on September 24, 2026, the suspected North Korean hackers behind the Bitget exchange breach are actively laundering stolen assets. On September 30, 2026, the attackers moved $3.9 million into Zcash's newly launched Ironwood shielded pool to encrypt transaction details. While NEAR Intents blocked over $50 million in attempted swaps, THORChain declined Bitget's freeze requests, processing millions in hacker-linked volume.

Movement of stolen Zcash

• ▪Zcash's Ironwood shielded pool, which launched on July 28, 2026, encrypts transaction details including the sender, receiver, and transfer amount, making subsequent fund movements untraceable
• ▪On September 30, 2026, hackers behind the Bitget exchange breach of September 24, 2026 transferred approximately 2,746 ZEC ($3.9 million, representing 15% of total ZEC stolen on September 24, 2026) into Zcash's Ironwood shielded pool across three transactions

Details of the Bitget breach

• ▪The Bitget breach occurred on September 24, 2026, resulting in the unauthorized transfer of approximately $387.5 million in assets, including XRP, ETH, USDT, USDC, and ZEC
• ▪Investigators traced the Bitget breach of September 24, 2026 to a zero-day exploit in a third-party security product, which allowed attackers to manipulate transaction data and bypass internal approvals without stealing private keys

Attribution to North Korean hackers

• ▪Bitget CEO Gracy Chen and blockchain analytics firm Elliptic attributed the $387.5 million Bitget breach of September 24, 2026 to North Korean state-sponsored hackers, citing IP addresses and behavioral patterns
• ▪If the North Korean attribution is confirmed, the Bitget breach of September 24, 2026 would push the total value of suspected North Korean cryptocurrency thefts past $1 billion for the year 2026

Attacker activity on THORChain

• ▪Bitquery estimated that approximately 29,088 ETH, worth roughly $79 million, was sent into THORChain and swapped for Bitcoin by the attackers behind the September 24, 2026 Bitget breach through September 29, 2026
• ▪THORChain declined Bitget's requests to block addresses linked to the $387.5 million Bitget theft, stating that selective censorship of individual swaps or funds would undermine the principles governing its network
• ▪THORChain processed over $1.5 billion in decentralized exchange volume in the days following the Bitget breach on September 24, 2026, compared to approximately $146 million during the week prior to the attack

NEAR Intents response

• ▪Following the Bitget breach of September 24, 2026, Near announced that the frozen $503,000 from the attacker's swap attempts will undergo legal and recovery proceedings
• ▪During NEAR Intents swap attempts tied to the Bitget attacker's wallets, the SHIELD risk system rejected more than $50 million, while approximately $503,000 was frozen mid-swap and roughly $166,000 successfully passed

Debatable claims

• ▪THORChain should block the cryptocurrency addresses linked to the Bitget hack
• ▪Zcash's shielded pools do more harm than good