Bitget hackers turn to Zcash on the day Wall Street's privacy-coin ETF completes its split

The Bitget hackers are testing a new route to move their $387.5 million loot out of recovery range as wallets tied to the suspected North Korean operators have pushed about $3.9 million into Zcash’s newest privacy pool, Ironwood, early on Wednesday, September 30.

Cryptopolitan reported in August that ZCSH was the first US ETF to offer spot exposure to ZEC when it debuted on NYSE Arca on August 25. And now, it is the same token that North Korea-linked attackers are using to launder a nine-figure theft.

Bitget hackers attempt to launder funds with Zcash

Once funds enter the Ironwood shielded pool, information such as the sender, the receiver, and the transfer amount can no longer be traced.

Investigators can still watch the amount entering the pool, and if any of it later surfaces at a public address, the exit amount becomes visible again. The best analysts can do is infer based on timing, values, and other metadata. However, they lose the critical thread directly linking the funds that entered and the money that exited.

The 2,746 ZEC that went into Ironwood were sent across three deposits between 08:15 and 08:46 UTC, after passing through two intermediary addresses that received funds from a wallet Bitget has already flagged.

Cryptopolitan reported that Ironwood went live on Zcash on July 28, 2026.

The first privacy ETF completes its splits on the same day 

The Bitget hack funds landed on Zcash on the same morning that the only US-listed ETF Wall for the token, the Grayscale Zcash ETF (ZCSH), completed a 3-for-1 forward share split.

Holders of record on September 28 received two extra shares for every one they owned, distributed after the close on September 29, and each pre-split share became three shares worth roughly a third of the old net asset value.

How is Bitget laundering the rest of the money?

The $3.9 million, first spotted by on-chain investigator ZachXBT, represents roughly 15% of the ZEC tokens that the attackers stole and are now being moved into incognito pools.

The shielded deposits are just one of the exit routes the hackers have probed. About $6.3 million has gone dark via Ether-to-Bitcoin swaps processed through THORChain.

The attempt to move more than $50 million through NEAR Intents’ SHIELD system failed, as the protocol froze $503,000, but not before about $166,000 was successfully processed, as reported by Cryptopolitan.

Circle and Tether also blacklisted an exploiter-linked wallet and froze $318,013 in stablecoins.

According to ZachXBT, the Chinese actors moving money for the alleged DPRK attackers were “openly asking for support” on September 28 in Discord servers and Telegram channels.

Bitget’s recovery push

Bitget has quickly moved to steady itself after taking the largest hit of 2026 to date. The company has confirmed that it has restored its user protection fund to $309 million, or about 3,705 Bitcoin, 131% above its $300 million commitment.

Withdrawals have reopened for users in phases, starting with BTC on September 28, ETH on September 29, and USDT on September 30. Other assets, fiat, and peer-to-peer services will return on October 2.

The smartest crypto minds already read our newsletter. Want in? Join them.