New money-laundering trails related to the Bitget September 24 security incident continue to emerge. On-chain investigator ZachXBT recently noted that the addresses associated with the Bitget attack have begun transferring approximately 2,700 Zcash (ZEC) into Zcash’s latest Ironwood privacy pool (shielded pool). Based on the current ZEC price of about $1,407, the involved funds are roughly $3.8 million to $3.9 million.
This is one of the more明显 privacy-preserving operations after the event. Unlike typical transparent addresses, once funds enter Ironwood, the sender, recipient, and transferred amount within the privacy pool are no longer directly公开, greatly increasing the difficulty for on-chain analytics entities to track the flow of funds.
About 2,700 ZEC entered Ironwood, accounting for roughly one-seventh of the stolen ZEC
Image source: ZachXBT
ZachXBT pointed out that this batch of addresses has gradually transferred about 2,700 ZEC into Ironwood. Based on currently disclosed information, about 18,900 ZEC was transferred in the Bitget incident, worth about $28.3 million at the time; in other words, the portion that has entered Ironwood now is roughly 14% to 15% of the stolen ZEC.
After Bitget officially corrected the reported losses from the incident on September 25, it confirmed that the total affected assets were about $387.5 million—higher than the initially announced $351.6 million. The added statistics mainly include assets such as Zcash and Tron that had not been fully accounted for earlier.
Bitget has also publicly released the main ZEC attacker address, “t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG,” and this address matches the source of funds traced by ZachXBT.
Why is it harder to track after entering Ironwood?
Zcash supports both transparent transactions and privacy transactions. If ZEC stays on transparent addresses, blockchain analysis is similar to Bitcoin: outsiders can see the source address, destination address, transfer time, and amount. But when ZEC moves from a transparent address into Ironwood, the transaction’s validity is verified using zero-knowledge proof technology, without公開ing the actual transaction details.
It is still possible to confirm which transparent addresses sent how much ZEC into Ironwood, and when they entered the pool. But once inside, determining who a specific amount of funds was sent to, how many parts it was split into, and which address ultimately submitted it becomes far more difficult. The continuous movement trail of funds on the public chain is cut off after entering Ironwood.
Law enforcement agencies and analytics companies can still monitor whether funds later leave the privacy pool again—especially if they flow into centralized exchanges or other services that require identity verification, which could allow new clues to be re-established.
Ironwood was only officially launched in July of this year
Ironwood is a very new privacy pool for Zcash. On July 28, 2026, at block height 3,428,143, Zcash activated the NU6.3 upgrade, formally introducing Ironwood and replacing the Orchard privacy pool that had previously been the primary one.
The background behind Ironwood going live is that earlier this year, Orchard’s proving circuit was found to have a serious soundness vulnerability, which in theory could allow attackers to create additional ZEC without being detected. Therefore, Zcash shut down Orchard to only allow funds to move out, and migrated new privacy transactions to Ironwood, while also adding a “turnstile” mechanism to ensure the total supply of funds entering and exiting the pool can be verified.
As of September 26, tracking data shows that the Ironwood pool contains about 3.99 million ZEC, with about 89.4% of funds from Orchard having completed the migration. The Bitget attacker did not choose an old-style Zcash privacy address, but instead the latest shielded pool currently used as Zcash’s main one.
At the time of this incident, ZEC itself was trading at a very high level. As of October 1, CoinGecko shows ZEC at around $1,407; the 24-hour price range is roughly $1,382 to $1,458. Its market-cap ranking is about 10th globally. ZEC is up about 13.7% over the past 7 days; up 20.9% over the past 14 days; and up 68.3% over the past 30 days. ZEC briefly rose to about $1,587 on September 27, and even exceeded $1,650 on September 26. Although it has recently pulled back somewhat, it remains near multi-year highs.
Why did the hacker start “shielding” only now?
The most notable thing about this operation is not the 2,700 ZEC itself, but that the way the funds are being handled has changed. In the early stages of the incident, the attacker first broke down various assets, performed cross-chain exchanges and conversions into assets with higher liquidity, and some transactions even attempted to use cross-chain systems such as THORChain and NEAR Intents. Now, by starting to send ZEC from transparent addresses into Ironwood, it indicates that at least part of the funds is beginning to move from “asset conversion” into a more clearly concealed source stage on the privacy chain.
ZachXBT’s view is that the attacker is only “beginning” the shielding, so the current 2,700 ZEC may just be the first batch. What’s worth watching next is whether the remaining roughly 16,000 ZEC continues to flow from known transparent addresses into the privacy pool. ZachXBT describes the attacker as a group suspected to be connected to North Korea.
Bitget CEO Gracy Chen also said that the attacker’s IP, VPN infrastructure, and fund-handling methods have similar characteristics to past North Korea–related hacking activity. However, as of now, no government agency has officially completed a public attribution.
Meanwhile, Bitget’s own recovery work is still ongoing. The latest official reserve proof shows that as of the 5:00 PM snapshot on September 29 (UTC+8), Bitget’s overall reserve ratio is 131%, covering 19 assets, all of which are above the 1:1 coverage line of 100%. Specifically, the BTC reserve ratio is 142%, ETH is 110%, and both USDT and XRP are 107%.
Bitget said the vulnerability has been patched, and the focus at this stage is on tracking and recovering assets. The platform has also launched a fund-recovery bounty program: if you help successfully freeze or recover the funds, you can receive a bounty of 5% of the relevant amount.
“[Bitget incident follow-up] The hacker transferred about 2700 ZEC into the Ironwood privacy pool, making tracking much more difficult.” This article was first published on (BlockBeats).