The hacker responsible for draining $387.5 million from crypto exchange Bitget has started moving portions of the stolen funds into Zcash's Ironwood shielded pool, a privacy-focused feature that encrypts sender, receiver, and transaction amounts.
On-chain investigator ZachXBT reported Wednesday that the attacker began depositing approximately 2,700 ZEC—roughly $3.8 million—into Ironwood, which launched July 28. While investigators can observe coins entering and exiting shielded pools, the transactions occurring within remain obscured from view.
How the Breach Occurred
The attack began September 24 when Bitget's systems detected unauthorized transfers from its internet-connected hot wallets. According to CEO Gracy Chen, attackers accessed backend systems and falsified transaction data rather than stealing private keys directly. Bitget stated that its protection fund covers customer losses.
Following the initial theft, the attacker distributed funds across multiple wallets in round denominations—approximately 10,000 ETH or 20 million XRP each—before routing smaller portions through cross-chain swap services including Thorchain, Across, Bridgers, Chainflip, and FixedFloat.
Exchange Responses Diverge
Cross-chain platforms took conflicting approaches to blocking the stolen funds. Near Intents reported that its SHIELD screening system rejected more than $50 million in swaps linked to the attacker. The service froze approximately $503,000 mid-swap and allowed roughly $166,000 to pass through.
Thorchain declined to implement selective transaction freezes. The decentralized exchange stated that network halts serve as emergency security mechanisms for the protocol itself, not as tools for freezing specific funds or addresses. Thorchain is operated by independent node operators who vote on halts rather than a centralized entity.
Despite Thorchain's position, the platform has halted operations previously. It suspended its network for approximately five weeks following a $10.7 million exploit on May 15, resuming June 22.
The hacker's transactions continued flowing through Thorchain. On Monday, multiple batches totaling roughly 2,390 ETH—approximately $6.3 million—were converted into 75.2 BTC through the platform, according to on-chain data.
Attribution and Recovery Efforts
Bitget CEO Gracy Chen and blockchain analytics firm Elliptic have pointed to IP addresses and transaction patterns consistent with North Korean hackers, though no government has confirmed attribution. Elliptic ranked the theft as the largest suspected North Korean cryptocurrency theft of 2026, bringing the year's total past $1 billion.
Bitget is offering a 5 percent bounty on any frozen funds and an additional 5 percent on recovered funds, excluding amounts recovered through court orders or law enforcement actions.
