The Bitget hacker has started moving stolen funds into Zcash's privacy pool, obscuring approximately $3.8 million worth of cryptocurrency.
Overview
- A hacker involved in the Bitget breach has begun hiding approximately 2,700 ZEC, worth around $3.8 million, in Zcash's Ironwood privacy pool as of September 30.
- Near Intents reported preventing over $50 million in transactions related to the hack, while Thorchain opted not to block the hacker's addresses.
- Bitget claims total losses from the incident amount to $387.5 million, with speculation about North Korean involvement, although no confirmation has been provided by authorities.
A breach at cryptocurrency exchange Bitget has led to the theft of $387.5 million, with the hacker now engaging in efforts to obscure part of the stolen funds. As confirmed by on-chain researcher ZachXBT, the hacker transferred around 2,700 ZEC—valued at approximately $3.8 million—into Zcash's Ironwood pool, which is designed for privacy and obscures transaction details.
The Ironwood pool, introduced on July 28, 2026, features enhanced security measures that prevent the tracing of deposits, making it a target for those looking to launder illicit funds. Although investigators can track overall movements in and out of the pool, the transactions in between remain concealed.
Gracy Chen, CEO of Bitget, noted a correlation between the attack's IP addresses and patterns associated with North Korean hackers. This theory is echoed by blockchain analysis firm Elliptic, which has characterized this breach as potentially the largest theft attributed to North Korea in 2026, pushing the total year's thefts beyond $1 billion.
The Breach Details
The unauthorized access was detected on September 24, when Bitget noticed irregular transactions from its hot wallets. Chen reported that the hackers were able to manipulate backend systems to create false transaction records without needing to steal private keys. Bitget has assured users that losses will be covered by its security fund.
Following the breach, the hacker initiated a laundering scheme, distributing funds into various wallets before using cross-chain platforms like Thorchain to obfuscate their movements. TRM Labs reported that attempts to swap over $50 million in assets connected to the hacker were blocked by Near Intents' screening system, which successfully froze around $503,000 while approximately $166,000 escaped.
Near plans to take legal actions regarding the frozen assets, reopening the discussion within the crypto community about the concept of "permissionless" transactions, with co-founder Illia Polosukhin stating this does not imply that all applications must process every transaction.
In contrast, Thorchain decided not to block the hacker’s addresses, emphasizing that its network is operated by independent node operators and can only halt transactions under specific conditions. On X, Thorchain stated that their halts are not designed for selectively freezing funds based on individual cases.
Throughout this period, the hacker continued to conduct trades, converting approximately $6.3 million worth of ETH into BTC via Thorchain. In response to the ongoing theft, Bitget announced a 5% bounty on any frozen funds and an additional 5% for any assets recovered, excluding those frozen under court orders or law enforcement directives.
