Bitget hackers move $3.9M into Zcash shielded pool as Grayscale’s ETF splits
- Wallets connected to the $387.5 million Bitget hack moved about $3.9 million in ZEC into Zcash’s Ironwood shielded pool.
- The transfer conceals roughly 15% of the stolen Zcash from investigators.
- Grayscale’s Zcash ETF completed a 3-for-1 share split on the same day, a rare intersection between Wall Street buyers and North Korea-linked launderers.
The Bitget hackers are testing a new route to move their $387.5 million loot out of recovery range as wallets tied to the suspected North Korean operators have pushed about $3.9 million into Zcash’s newest privacy pool, Ironwood, early on Wednesday, September 30.
Cryptopolitan reported in August that ZCSH was the first US ETF to offer spot exposure to ZEC when it debuted on NYSE Arca on August 25. And now, it is the same token that North Korea-linked attackers are using to launder a nine-figure theft.
Bitget hackers attempt to launder funds with Zcash
Once funds enter the Ironwood shielded pool, information such as the sender, the receiver, and the transfer amount can no longer be traced.
Investigators can still watch the amount entering the pool, and if any of it later surfaces at a public address, the exit amount becomes visible again. The best analysts can do is infer based on timing, values, and other metadata. However, they lose the critical thread directly linking the funds that entered and the money that exited.
The 2,746 ZEC that went into Ironwood were sent across three deposits between 08:15 and 08:46 UTC, after passing through two intermediary addresses that received funds from a wallet Bitget has already flagged.
Cryptopolitan reported that Ironwood went live on Zcash on July 28, 2026.
The first privacy ETF completes its splits on the same day
The Bitget hack funds landed on Zcash on the same morning that the only US-listed ETF Wall for the token, the Grayscale Zcash ETF (ZCSH), completed a 3-for-1 forward share split.
Holders of record on September 28 received two extra shares for every one they owned, distributed after the close on September 29, and each pre-split share became three shares worth roughly a third of the old net asset value.
How is Bitget laundering the rest of the money?
The $3.9 million, first spotted by on-chain investigator ZachXBT, represents roughly 15% of the ZEC tokens that the attackers stole and are now being moved into incognito pools.
The shielded deposits are just one of the exit routes the hackers have probed. About $6.3 million has gone dark via Ether-to-Bitcoin swaps processed through THORChain.
The attempt to move more than $50 million through NEAR Intents’ SHIELD system failed, as the protocol froze $503,000, but not before about $166,000 was successfully processed, as reported by Cryptopolitan.
Circle and Tether also blacklisted an exploiter-linked wallet and froze $318,013 in stablecoins.
According to ZachXBT, the Chinese actors moving money for the alleged DPRK attackers were “openly asking for support” on September 28 in Discord servers and Telegram channels.
Bitget’s recovery push
Bitget has quickly moved to steady itself after taking the largest hit of 2026 to date. The company has confirmed that it has restored its user protection fund to $309 million, or about 3,705 Bitcoin, 131% above its $300 million commitment.
Withdrawals have reopened for users in phases, starting with BTC on September 28, ETH on September 29, and USDT on September 30. Other assets, fiat, and peer-to-peer services will return on October 2.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
How much of the stolen Zcash did the Bitget hackers hide?
Wallets tied to the hack moved 2,746 ZEC, worth about $3.9 million, into the Ironwood shielded pool in three transfers on September 30, representing roughly 15% of the stolen ZEC.
What is Ironwood and why does it make funds hard to trace?
Ironwood is Zcash's newest shielded pool, activated on July 28, 2026, as the NU6.3 upgrade; it hides the sender, recipient, and amount of transfers inside the pool, so investigators cannot read a direct trail even though they can see money entering.
What happened with Grayscale's Zcash ETF on the same day?
Grayscale said its Zcash ETF (ZCSH) completed a 3-for-1 forward share split effective before market open on September 30, with each pre-split share becoming three post-split shares that continue trading on NYSE Arca, without changing the total value of a holder's investment.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
