Hackers behind the $387.5 million Bitget theft are testing a new route to move their loot beyond the reach of recovery efforts. Early on Wednesday, September 30, wallets tied to the suspected North Korean operators pushed about $3.9 million into Ironwood, Zcash's newest shielded pool.

Cryptopolitan reported in August that ZCSH was the first US ETF to offer spot exposure to ZEC when it debuted on NYSE Arca on August 25. The same token is now at the center of a nine-figure laundering operation run by North Korea-linked attackers.

How the Ironwood pool obscures the trail

Once funds enter the Ironwood shielded pool, details such as the sender, the receiver, and the transfer amount can no longer be traced.

Investigators can still monitor how much enters the pool, and if any of it later surfaces at a public address the exit amount becomes visible again. Analysts can only draw inferences from timing, values, and other metadata, but they lose the critical thread directly linking the funds that entered to the money that exited.

The 2,746 ZEC that reached Ironwood arrived in three deposits between 08:15 and 08:46 UTC, after passing through two intermediary addresses that had received funds from a wallet Bitget has already flagged. Cryptopolitan reported that Ironwood went live on Zcash on July 28, 2026 — a little over two months before the stolen ZEC arrived.

A share split lands the same morning

The hack funds landed on Zcash on the same morning that the only US-listed ETF for the token, the Grayscale Zcash ETF (ZCSH), completed a 3-for-1 forward share split. Holders of record on September 28 received two extra shares for every share they owned, distributed after the close on September 29. Each pre-split share became three shares worth roughly a third of the old net asset value — the standard effect of a forward split, which lowers the per-share price without changing the value of a holder's overall position.

The remaining laundering routes

The $3.9 million, first spotted by on-chain investigator ZachXBT, represents roughly 15% of the ZEC the attackers stole and are now moving into privacy pools. The remaining roughly 85% of that ZEC has not been tracked into shielded pools so far, making the pool's entry and exit totals the figures to watch next.

The shielded deposits are only one of the exit routes the hackers have probed. About $6.3 million has gone dark through Ether-to-Bitcoin swaps processed via THORChain, a cross-chain swap protocol. An attempt to move more than $50 million through NEAR Intents' SHIELD system failed after the protocol froze $503,000, though not before roughly $166,000 was successfully processed, as reported by Cryptopolitan. The contrast between the two venues underlines how recovery outcomes can hinge on whether a protocol's controls intercept flagged funds before they settle.

Circle and Tether have also blacklisted an exploiter-linked wallet and froze $318,013 in stablecoins — a lever that binds wherever those tokens travel, since centralized stablecoins remain under their issuers' control even as they move between wallets.

According to ZachXBT, the Chinese actors moving money for the alleged DPRK attackers were "openly asking for support" on September 28 in Discord servers and Telegram channels.

Bitget's recovery push

Bitget has moved quickly to steady itself after taking the largest hit of 2026 to date. The company confirmed that it has restored its user protection fund to $309 million, or about 3,705 Bitcoin, 131% above its $300 million commitment.

Withdrawals have reopened for users in phases, beginning with BTC on September 28, followed by ETH on September 29 and USDT on September 30. Other assets, fiat, and peer-to-peer services will return on October 2, the final scheduled phase of the exchange's restoration timetable.