Privacy Coins Security Current Affairs

Bitget Thieves Are Now Washing Stolen Coins Through Zcash's Privacy Layer

2026-09-30

Six days after the $387.5 million Bitget breach, the stolen funds are fragmenting. Fast. And the latest move tells us exactly where this is heading: privacy coins.

On Wednesday, blockchain sleuths spotted nearly $3.9 million worth of Zcash being funnelled into Ironwood, Zcash's newest shielded pool. Three rapid transactions. 2,746 ZEC in total. That's roughly 15 percent of the 18,900 ZEC stolen on September 24. ZachXBT caught it early and raised the flag, which meant exchanges and security firms got to watch it happen in real time. Small victory.

Here's where it gets messy. Zcash runs a dual-layer system. You can do transparent transactions—blockchain visible, Bitcoin-style. Or you can go shielded. Once money hits a shielded pool like Ironwood, the sender, recipient, and amount all vanish. Encrypted. Gone. You can see the entry point—the money going in. But anything after that? Nothing. No trail. If the thief later withdraws to a public address, you see the exit. But the link between entry and exit doesn't exist on-chain. Timing patterns might help investigators connect dots, but the protocol itself offers nothing. It's a gap built into the system. And sophisticated launderers know exactly how to use it.

This shift signals a recognition. Earlier, the attacker was moving Ethereum through THORChain, a decentralised cross-chain swap service. About $6.3 million in stolen ETH converted to Bitcoin across 27 trades. All visible on both blockchains. All trackable. That vulnerability mattered, and the thief noticed.

Now they're layering in privacy infrastructure. No longer just speed and cross-chain hopping. Now they're deliberately obscuring the flow. That's tactical escalation.

Bitget's CEO Gracy Chen says this is North Korean state-sponsored activity. Matching IP addresses. Behavioural patterns consistent with previous state-backed breaches. Whether that attribution holds or not, the Zcash move suggests professional operators with access to proper laundering playbooks.

This also exposes the hard limit on what exchanges can actually do in recovery efforts. Bitget identified the attacker addresses and offered a 5 percent bounty for help. Reasonable response. But when stolen assets scatter across transparent chains, mixing services, and privacy pools? Recovery options narrow to a point. Privacy protocols have no kill switches. Decentralised services like THORChain refuse to selectively freeze identified attacker addresses because they're designed to be permissionless. No exceptions. No backdoors.

Law enforcement becomes the only realistic lever. On-chain intervention tools don't work against networks designed specifically to prevent on-chain intervention.

Bitget has phased withdrawals back online and confirmed customer balances stayed intact. The User Protection Fund ate the loss. That's competent damage control. But asset recovery? That depends on police work now, not blockchain analysis. Every new laundering route the attacker activates pushes recovery prospects further out.

Source & further reading:

Sources