New laundering traces have emerged in the Sept. 24 Bitget security incident. On-chain investigator ZachXBT said addresses linked to the attack have started moving about 2,700 Zcash (ZEC) into Ironwood, Zcash’s newest shielded pool. At a current ZEC price of about $1,407, the funds are worth roughly $3.8 million to $3.9 million.
This is one of the clearest ZEC privacy moves seen since the incident. Once funds enter Ironwood, the sender, recipient, and transfer amount inside the pool are no longer directly visible on-chain, making fund tracing much harder for blockchain analytics firms.
About 2,700 ZEC has entered Ironwood
ZachXBT said the addresses have gradually moved about 2,700 ZEC into Ironwood. Based on currently disclosed data, about 18,900 ZEC was moved in the Bitget incident, worth about $28.3 million at the time. That means the portion already sent into Ironwood represents roughly 14% to 15% of the stolen ZEC.
On Sept. 25, Bitget revised its loss estimate and said total affected assets were about $387.5 million, up from the initially disclosed $351.6 million. The added amount mainly reflected assets such as Zcash and Tron that had not been fully included earlier.
Bitget also published a main attacker ZEC address, “t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG,” which matches the source of funds tracked by ZachXBT.
Why tracing gets harder after funds enter Ironwood
Zcash supports both transparent and private transactions. If ZEC remains in transparent addresses, analysis works in a way similar to Bitcoin: outside observers can see the source address, destination address, transfer time, and amount.
Once ZEC moves from a transparent address into Ironwood, however, the transaction is validated through zero-knowledge proofs without exposing the underlying transaction details. Analysts can still see which transparent addresses sent how much ZEC into Ironwood and when those deposits happened. After the funds are inside the pool, though, it becomes much harder to determine who received a given transfer, how the funds were split, or which address eventually withdrew them. The continuous public trail is cut once the funds enter Ironwood.
Law enforcement agencies and analytics companies can still watch for funds leaving the privacy pool later. If the assets move into a centralized exchange or another service that requires identity verification, investigators may be able to rebuild leads.
Ironwood went live in July 2026
Ironwood is a relatively new privacy pool for Zcash. On July 28, 2026, at block height 3,428,143, Zcash activated the NU6.3 upgrade and formally introduced Ironwood, replacing Orchard as the main privacy pool.
Ironwood was launched after a serious soundness flaw was found earlier this year in the Orchard proving circuit. In theory, that flaw could have allowed an attacker to create extra ZEC without being detected. Zcash then restricted Orchard to withdrawals only, migrated new private transactions to Ironwood, and added a “turnstile” mechanism to make the total supply moving in and out of the pool verifiable.
As of Sept. 26, tracking data showed about 3.99 million ZEC in the Ironwood pool, while about 89.4% of Orchard funds had completed migration. The Bitget attacker did not choose an older Zcash privacy address format, but the latest and primary shielded pool now used by the network.
ZEC remains near multi-year highs
The transfers came while ZEC itself was trading at elevated levels. As of Oct. 1, CoinGecko showed ZEC at about $1,407, with a 24-hour range of roughly $1,382 to $1,458 and a market-cap ranking of about No. 10 globally.
ZEC was up about 13.7% over the past seven days, 20.9% over 14 days, and 68.3% over 30 days. The token briefly reached about $1,587 on Sept. 27 and had even moved above $1,650 on Sept. 26. Prices have pulled back since then, but ZEC is still trading near multi-year highs.
The handling of funds has shifted
The key point is not only the 2,700 ZEC itself, but the change in how the funds are being handled. In the early stage of the incident, the attacker split multiple assets, used cross-chain swaps, and converted holdings into more liquid assets. Some transactions also attempted to use cross-chain systems such as THORChain and NEAR Intents.
Now that ZEC is being sent from transparent addresses into Ironwood, at least part of the operation appears to be moving from asset conversion into a more explicit phase of obscuring on-chain origin. ZachXBT said the attacker had only “begun” shielding, which suggests the current 2,700 ZEC may be only the first batch. The next point to watch is whether the remaining roughly 16,000 ZEC will also move from known transparent addresses into the privacy pool.
Attribution remains unconfirmed by any government agency
ZachXBT described the attacker as a group suspected of links to North Korea. Bitget CEO Gracy Chen has also said the IPs, VPN infrastructure, and fund-handling patterns used in the attack resembled past hacking activity associated with North Korea.
So far, however, no government agency has publicly completed a formal attribution.
Bitget disclosed reserve ratios and a bounty plan
Separately, recovery work at Bitget is still ongoing. According to the exchange’s latest proof-of-reserves disclosure, a snapshot taken at 17:00 on Sept. 29 (UTC+8) showed an overall reserve ratio of 131% across 19 assets, all above the 100% 1:1 coverage line.
- BTC reserve ratio: 142%
- ETH reserve ratio: 110%
- USDT reserve ratio: 107%
- XRP reserve ratio: 107%
Bitget said the vulnerability behind the incident has been patched and that its current focus is on tracing and recovering assets. The platform has also launched a recovery bounty program that offers a 5% reward on funds successfully frozen or recovered.