The hacker responsible for the $387.5 million theft from the Bitget exchange has begun laundering funds through the Ironwood shielded pool on the Zcash blockchain. Investigator ZachXBT reported that approximately 2,700 ZEC, valued at about $3.8 million, were moved into the privacy-focused pool. Ironwood replaced the Orchard pool on July 28 following the discovery of a security vulnerability.
The attack, which began on September 24, involved unauthorized transfers from Bitget hot wallets after attackers compromised backend systems. Bitget CEO Gracy Chen stated that customer balances remain unaffected due to the company's protection fund. Elliptic identified the incident as the largest suspected North Korean theft of 2026, contributing to a total of over $1 billion in losses for the year.
The attacker utilized various cross-chain swap services to launder the stolen assets, including Thorchain, Across, Bridgers, Chainflip, and FixedFloat. Near Intents reported that its SHIELD system rejected over $50 million in swaps linked to the attacker, successfully freezing $503,000, while $166,000 was processed.
Thorchain declined to block the attacker's addresses, stating that network halts are reserved for emergency protocol protection rather than freezing specific transactions. This decision follows a previous five-week network halt in May 2026 after a $10.7 million exploit. On-chain data indicates that the attacker converted roughly 2,390 ETH into 75.2 BTC via Thorchain.
Bitget has announced a bounty program offering 5% of any funds frozen and an additional 5% of any funds recovered, excluding actions mandated by law enforcement or court orders.
