Bitget Hacker Turns to Zcash Privacy Pool After Near Rejects $50M in Swaps

The hacker responsible for draining $387.5 million from cryptocurrency exchange Bitget has begun concealing a portion of the stolen funds within Zcash’s privacy pool.

On-chain investigator ZachXBT reported on Wednesday that the attacker started routing approximately 2,700 ZEC—valued at around $3.8 million—into Ironwood, a shielded pool on the privacy-centric Zcash network. Shielded pools encrypt sender information, receiver details, and transaction amounts, making it impossible to trace the funds once they enter. Ironwood debuted on July 28, replacing the older Orchard pool following the discovery of a vulnerability that could have permitted unauthorized coin minting.

On-chain tracking indicates this deposit represents about one-seventh of the ZEC stolen during the breach. While investigators can track coins entering and exiting the pool, the transactions occurring within remain entirely obscured.

Near Intents announced it blocked over $50 million in swaps associated with the breach, whereas Thorchain reportedly turned down Bitget’s appeal to blacklist the attacker’s wallet addresses.

Bitget estimates the total loss at $387.5 million. Bitget CEO Gracy Chen and blockchain analytics firm Elliptic have both pointed to indications of North Korean involvement, though official government confirmation is lacking. Elliptic described a North Korean connection as “highly likely” and classified the incident as the largest suspected North Korean crypto theft of 2026, elevating total losses for the year past $1 billion.

The security breach originated on Sept. 24, when Bitget systems detected unauthorized withdrawals from its hot wallets—the internet-connected storage used for daily exchange liquidity. Chen explained that the perpetrators breached backend infrastructure to spoof transaction data rather than utilizing traditional exploits.