Skip to content

Back to the catalog

Bitget Hacker Turns to Zcash Privacy Pool After Near Rejects $50M in Swaps
decrypt.coarticle

Bitget Hacker Turns to Zcash Privacy Pool After Near Rejects $50M in Swaps

Decrypt reports that the attacker behind Bitget's $387.5M hot-wallet theft (Sept. 24) began shielding ~2,700 ZEC (~$3.8M) in Zcash's new Ironwood privacy pool, per on-chain investigator ZachXBT. Bitget's CEO and Elliptic attribute the heist to North Korea, and TRM Labs traced laundering through round-number wallet splits and cross-chain swap services including Thorchain, Across, Bridgers, Chainflip, and FixedFloat. Near Intents' SHIELD screening blocked over $50M in related swaps while Thorchain refused to selectively halt the attacker's addresses, spotlighting the gap between blockchain "permissionless" design and real-time sanctions/freeze response during active exchange-hack laundering.

TL;DR Bitget's $387.5M hack (attributed to North Korea) is being laundered through Thorchain, Near Intents, and Zcash's Ironwood shielded pool, exposing how cross-chain swap services and privacy pools resist freeze requests during active DPRK laundering.
Open original ↗
Document

What it is

Follow-up reporting on the Bitget $387.5M exchange hack, adding the attacker's intrusion method and hard numbers the summary omits. The theft began Sept. 24; laundering is ongoing, with ~2,700 ZEC moved into Zcash's Ironwood shielded pool on Sept. 30.

How the breach worked

Per Bitget CEO Gracy Chen, the attackers did not steal private keys. They compromised Bitget's backend systems and faked transaction data to move funds out of the internet-connected hot wallets. This is the defensively relevant detail the summary leaves out: the failure was in transaction authorization/integrity on the backend, not key custody. Bitget's protection fund covers the loss, so customer balances are unaffected.

Laundering mechanics and numbers

  • Round-number wallet splits (TRM Labs): fresh wallets holding ~10,000 ETH or ~20M XRP each, then smaller chunks pushed through cross-chain swaps (Thorchain, Across, Bridgers, Chainflip, FixedFloat).
  • Near Intents / SHIELD: rejected >$50M in related swaps; ~$503K frozen mid-swap, ~$166K slipped through. Frozen funds go to legal/recovery.
  • Ironwood deposit: ~$3.8M, roughly one-seventh of the stolen ZEC. Ironwood launched July 28 to replace Orchard after a bug that could have allowed counterfeit coin minting. Investigators can see coins enter and exit but not the path between.
  • Thorchain flow continued: on the Monday before publication, ~2,390 ETH (~$6.3M) was converted to 75.2 BTC through Thorchain.

The Thorchain inconsistency (the actionable argument)

Thorchain declined Bitget's request to block the attacker's addresses, arguing a network halt is an emergency protocol-protection tool run by independent node-operator votes, not a selective freeze. The page supplies the direct counterpoint: Thorchain halted its entire network for ~5 weeks (May 15 → June 22, 2026) after a $10.7M exploit of its own liquidity pools. So the capability to stop transactions exists; it was exercised for self-protection but withheld for a third-party victim. If you depend on any permissionless swap venue for freeze/recovery response, treat that response as unavailable by default.

Caveats

North Korea attribution is from Bitget's CEO ("IP and pattern match") and Elliptic ("highly likely" / largest suspected DPRK theft of 2026); no government has confirmed it. Bitget offers a 5%-frozen + 5%-recovered bounty, excluding court/law-enforcement actions.

Technologies named here

Techniques named here

  • Hot wallet compromise via backend system intrusion
  • Fund splitting into round-amount wallets
  • Cross-chain swap laundering
  • Shielded/privacy pool laundering

Threat actors named here

Related in Blockchain