Bitget's hackers push $3.9 million of stolen ZEC into Zcash's untraceable Ironwood pool

Divide $3.9 million by 2,746 coins and the hackers were shielding ZEC at about $1,420 a coin ^[16]. Cryptopolitan reports that the deposit is 15% of the Zcash taken ^[5]. On that figure, the ZEC slice of the theft was about 18,300 coins, or roughly $26 million ^[17]. That is under 7% of a $387.5 million haul ^[18].

The laundering that has worked so far is also small next to the headline figure. The shielded deposit, the $6.3 million swapped from Ether to Bitcoin on THORChain ^[7] and the roughly $166,000 that got through NEAR Intents ^[8] add up to about $10.4 million out of sight ^[19]. Against that, NEAR Intents froze $503,000 ^[8] and Circle and Tether froze $318,013 ^[10], about $821,000 in all ^[20]. Divide the first sum by the second and the hackers are ahead by about 12.6 to 1 ^[21]. The two sums together come to under 3% of what was stolen ^[25].

Every frozen dollar sat with a party able to act on it. In one case that was the protocol behind NEAR Intents' SHIELD system, and in the other the two stablecoin issuers ^[8][10]. The $10.2 million routed through THORChain and Ironwood went dark ^[22].

The ETF and the deposit fall on the same date. Grayscale's ZCSH became the first US ETF with spot ZEC exposure when it listed on NYSE Arca on August 25 ^[11]. Its 3-for-1 split took effect before the open on September 30, turning each share into three, each worth about a third of the old net asset value ^[12]. Cryptopolitan calls it "a rare intersection between Wall Street buyers and North Korea-linked launderers" ^[15]. The account does not report fund flows, a regulator's response or any comment from Grayscale.

From here the money can go three ways. If the hackers keep feeding ZEC into Ironwood, Zcash's documented laundering case grows while a listed fund holds the token. They could lean on THORChain instead, since it has already carried more than the shielded pool ^[7][1]. Or the Chinese intermediaries could fail to find the help they were after. ZachXBT said the Chinese actors moving money for the alleged DPRK attackers were "openly asking for support" in Discord servers and Telegram channels on September 28 ^[13].

I think the reputational charge against the ETF runs ahead of this evidence. More of the money that cleared went through THORChain than through Zcash's pool ^[7][1]. The split also changed share counts and left the value of holdings where it was ^[12]. The counter-case is that size does not matter to a regulator. On that view, wallets Cryptopolitan ties to suspected North Korean operators using Zcash's newest pool is something a regulator can cite whatever the amount ^[2]. ZCSH outflows, or a regulator naming Zcash, in the weeks after September 30 would prove this view wrong.

Cryptopolitan calls the theft the largest hit of 2026 to date ^[3]. Bitget has since refilled its user protection fund to $309 million, about 3,705 bitcoin ^[27]. The report puts that at 131% above the exchange's $300 million commitment ^[27]. The two figures put it about 3% above ^[28].