---
title: "Bitget Hack: $4M Zcash Transfer Raises Tracking Fears"
date: 2026-09-30
author: "Kelvin Scott"
featured_image: "https://coinlaw.io/wp-content/uploads/2026/09/bitget-hackers-zcash-fund-transfer-zachxbt.jpg"
categories:
  - name: "Cryptocurrency"
    url: "/crypto.md"
tags:
  - name: "News"
    url: "/tag/news.md"
---

# Bitget Hack: $4M Zcash Transfer Raises Tracking Fears

Alleged DPRK attackers began shielding stolen Zcash from the Bitget exploit into the Ironwood pool on September 30, 2026, on-chain investigator ZachXBT said. The transfers follow the theft from Bitget’s hot wallet.

## The Brief

- ZachXBT says the alleged attackers began shielding about 2,700 ZEC ($3.8 million) into the Ironwood pool.
- ZachXBT says the attackers took about 18,900 ZEC ($28.3 million) from the Bitget hot wallet on September 24, 2026.
- ZachXBT published the deposit transactions and a theft source address for others to check.
- The North Korea link is ZachXBT’s allegation. It is not a finding confirmed by Bitget.

## What Happened?

In a Telegram post, **ZachXBT** said the alleged DPRK (North Korean) attackers had started routing part of the [stolen Zcash into a shielded pool](https://coinlaw.io/bitget-freezes-withdrawals-351-million-hack/). He listed the Ironwood deposit transactions and a theft source address. The post gives no times for the deposits and no count of individual transfers. Neither Bitget nor Zcash developers are quoted in the material reviewed for this story.

> 🚨BREAKING: ZachXBT says alleged DPRK attackers are now shielding stolen Bitget funds through Zcash.  
>   
> Around 2,700 [$ZEC](https://x.com/search?q=%24ZEC&src=ctag&ref_src=twsrc%5Etfw), worth $3.8M, has reportedly started moving into Zcash’s Ironwood.  
>   
> This means the stolen ZEC is now being pushed into a shielded pool, where transaction… [pic.twitter.com/sFI8WSL5i7](https://t.co/sFI8WSL5i7)
> 
> — Coin Bureau (@coinbureau) [September 30, 2026](https://x.com/coinbureau/status/2105244855953707476?ref_src=twsrc%5Etfw)

 About 14% of the stolen ZEC has entered Ironwood so far. The same figures leave roughly **16,200 ZEC** outside the pool. The post does not say where that balance sits or whether more deposits are expected. A partial move can be a test run or a first batch.

## ZachXBT Monitoring the Chain

ZachXBT tied the move to a live debate inside [crypto privacy](https://coinlaw.io/privacy-coins-vs-regulatory-compliance-statistics/). He noted that competing privacy projects argued that threat actors do not use ZEC thus XYZ is better.

A hack whose proceeds are partly shielded in Zcash cuts against that pitch, whatever it says about the coin’s design. The wording is ZachXBT’s summary of the argument, not a quote from a named project.

The published transaction list is a fixed baseline. Later deposits into Ironwood can be measured against it, and the untouched balance is the number to watch.

Definition of Hot Wallet. Link to full glossary entry follows the description.**Hot Wallet**A hot wallet is an internet-connected crypto wallet for fast transactions and [DeFi](https://coinlaw.io/glossary/defi/) access, but it carries higher security risks than offline storage.

[Read more](https://coinlaw.io/glossary/hot-wallet/)