Bitget Hackers Move $3.8M in ZEC Into Ironwood
A week after Bitget disclosed a major security breach, part of the stolen Zcash is moving somewhere conventional address tracking becomes far less useful.
Summary:
- Three transactions moved roughly 2,700 stolen ZEC into Ironwood.
- About 16,200 ZEC remains outside this initial shielding wave based on the reported totals.
- The transfers provide a concrete case of allegedly DPRK-linked funds using Zcash’s current shielded infrastructure.
Around 2,700 ZEC worth $3.8 million has been moved from the attacker’s transparent address into Zcash’s Ironwood shielded pool, according to on-chain transactions shared on Sept. 30 from ZachXBT.
The transfers originate from t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG, the same ZEC address Bitget publicly identified in connection with the Sept. 24 exploit.
Bitget said approximately 18,900 ZEC worth $28.3 million was stolen. The first Ironwood deposits therefore account for roughly 14% of that amount.
For blockchain investigators, the important development is not simply that stolen ZEC is moving. It is where it is moving and what information remains publicly available afterward.
Three Transactions Connect the Theft to Ironwood
The initial shielding activity can be narrowed to three transactions:
- 9bf8d13474eff83ee9fcb214a3df7e1d1acbb745a0f820c837c08eb35e1e4e1a
- 61d2cb335127636f2854e587dd41fecf2ec31c9c1e9e5e5b543c3a416048b258
- 64e5a66cce034745dfe1447b4779ce37b910d99365d0583cef65eb0504b573a2
Their significance comes from the source. Bitget previously published t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG among the attacker-controlled addresses identified during its investigation.
The ZEC theft was discovered after Bitget expanded its accounting of the Sept. 24 incident. The exchange initially estimated losses at $351.6 million before revising the total to approximately $387.5 million after identifying additional Zcash and Tron transfers.
The revision did not represent a second breach. It reflected assets that were not included in Bitget’s initial calculation.
What Ironwood Changes for Investigators
A transparent Zcash address exposes information that blockchain analysts are accustomed to working with: its balance, incoming transactions and subsequent transfers can be followed publicly.
Shielded transactions are designed differently.
Ironwood became Zcash’s active shielded pool following the NU6.3 network upgrade in July 2026. It builds on Zcash’s existing shielded architecture and maintains its own note commitment tree, nullifier set and value pool.
When ZEC moves from a transparent address into Ironwood, investigators can observe the deposit. Public blockchain data, however, does not provide the same direct mapping between that deposit and later shielded outputs.
That distinction affects forensic methodology.
Analysts still know how much stolen ZEC entered the pool and which known address supplied it. What they cannot do through ordinary address tracing is simply follow those same coins from one visible address to another once subsequent activity remains shielded.
Any further attribution can require additional evidence, including timing patterns, interactions with transparent addresses, exchange deposits or information obtained from services receiving the funds.
Zcash Now Has a Concrete Criminal-Use Case for Ironwood
The transfers are also relevant to a long-running debate around privacy coins.
Arguments about privacy networks often focus on which assets sophisticated threat actors actually use. Bitcoin and stablecoins have historically provided investigators with large volumes of visible illicit activity, while privacy-focused networks are sometimes discussed through their theoretical ability to obscure transaction relationships rather than individual high-profile cases.
The Bitget exploit provides a specific counterexample for Zcash.
Here, an attacker holding tens of millions of dollars in stolen ZEC has begun using the network’s newest shielded pool after initially leaving the funds at a transparent address.
One incident cannot establish how frequently sophisticated criminal groups use Zcash, nor does it show that Ironwood itself was created or primarily used for illicit activity. It does establish something narrower and verifiable: stolen funds from a major exchange exploit are now entering its shielded infrastructure.
That makes the case more useful than generalized claims about which privacy technology criminals prefer.
The DPRK Link Is Stronger Than the Identity Claim
The blockchain evidence and attacker attribution should remain separate.
The ZEC transactions can be linked to an address disclosed by Bitget. The identity of the people controlling that address cannot be established from those transactions alone.
Bitget and blockchain-intelligence researchers have pointed to indicators consistent with North Korean-linked threat actors, including similarities with infrastructure and techniques associated with previous DPRK operations. The attacker should therefore still be described as alleged or suspected DPRK-linked rather than definitively identified as such.
That distinction does not affect the Ironwood analysis. Whoever controls the wallet, the observable event remains the same: ZEC from the disclosed Bitget theft address has begun entering the shielded pool.
16,200 ZEC Is Now the Number to Watch
Based on the reported totals, approximately 16,200 of the stolen 18,900 ZEC was not included in the first 2,700 ZEC shielding activity.
Its next destination could determine how significant Ironwood becomes to the Zcash portion of the investigation.
If the remaining balance stays transparent or moves to identifiable services, investigators retain more conventional tracing opportunities. Further Ironwood deposits would increase the amount of stolen ZEC for which direct address-to-address tracking becomes unavailable after shielding.
That is the next useful data point in the Bitget case.
Not whether the attacker can move ZEC, but how much of the remaining $28.3 million Zcash theft ultimately disappears from transparent address-level tracing.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
