Wallets linked to the Bitget hack moved about $3.9 million worth of Zcash (ZEC) into Ironwood, a private payment pool on the Zcash network. The transfers make the assets more difficult to trace while they remain inside the shielded pool.

Three transfers totaling 2,746 ZEC took place between 08:15 and 08:46 UTC on Wednesday, Sept. 30, six days after the breach. The amount represents about 15% of the ZEC stolen in the Sept. 24 breach, which drained $387.5 million from the exchange.

Blockchain investigator ZachXBT first identified the movements. CoinDesk reviewed the transaction records and reported the deposits into Ironwood. The report is available at

🚨BREAKING: ZachXBT says alleged DPRK attackers are now shielding stolen Bitget funds through Zcash. Around 2,700 $ZEC , worth $3.8M, has reportedly started moving into Zcash’s Ironwood. This means the stolen ZEC is now being pushed into a shielded pool, where transaction… pic.twitter.com/sFI8WSL5i7 — Coin Bureau (@coinbureau) September 30, 2026

The Coin Bureau post is available at https://x.com/coinbureau/status/2105244855957476?ref_src=twsrc%5Etfw. The attribution of the attack to alleged DPRK-linked attackers comes from ZachXBT, as relayed in the post above.

How Ironwood Shields Transactions

Zcash supports both transparent and shielded transactions. In a transparent transaction, the details are publicly visible. A shielded transaction uses a private pool such as Ironwood, where the sender, recipient and exact amount are hidden once the funds enter the pool.

That privacy is the option Zcash extends to its users, and it is the same property that removes the transaction trail investigators would otherwise follow in a case like this.

Observers can still see that funds entered the shielded pool, but they cannot see what happens to those funds while they remain inside. If the assets later leave the pool for a public address, that outgoing transaction becomes visible again. Investigators can then compare details such as timing and transaction size with earlier deposits, although such comparisons do not guarantee a match.

According to ZachXBT, the funds moved through two intermediary addresses before reaching Ironwood. Those addresses were funded by a wallet that Bitget has identified as belonging to the attacker. The same wallet received close to 18,917 ZEC when the breach occurred on Sept. 24, meaning the recent deposits account for only part of the stolen ZEC.

Bitget continues to work on recovering the stolen assets. Moving funds into a shielded pool can make that process more difficult by limiting the transaction information available to investigators.

Earlier Transfers Through THORChain

The Ironwood deposits are not the first effort linked to the Bitget breach to obscure the movement of the stolen funds. CoinDesk previously traced about $6.3 million worth of ether that was exchanged for bitcoin through THORChain.

Those transactions left a visible record: investigators could observe the ether entering THORChain and the bitcoin leaving it. By contrast, activity inside the Zcash shielded pool is not publicly visible while the funds remain there, creating a different tracking challenge.

As of Wednesday, no new movements out of Ironwood had been reported. The stolen assets remained distributed across multiple routes, with some transfers visible on public blockchains and others hidden within the Zcash shielded pool. Whether more of the stolen ZEC follows into the pool, and where any of it resurfaces if it later leaves, remained open questions.

The original CoinCentral report is available at https://coincentral.com/bitget-hack-funds-moved-into-zcash-shielded-pool-hiding-3-9-million/