The Bitget Thief Hides 2,700 ZEC in Zcash's Ironwood Pool
On September 30, the attacker who stole $387.5 million from the Bitget exchange began transferring approximately 2,700 ZEC, worth $3.8 million, to the Ironwood pool of the privacy-focused Zcash blockchain. According to on-chain investigator ZachXBT, this operation represents about one-seventh of the total amount of ZEC stolen.
Quick Response
The attacker transferred 2,700 ZEC to Zcash's Ironwood pool to hide part of the loot. Zcash's shielded pools encrypt sender, recipient, and amount, making it impossible to track movements within the pool. The attack on Bitget was valued at $387.5 million, with clues pointing to North Korean hackers.
How Zcash's Shielded Pools Work
Shielded pools like Ironwood represent a part of the Zcash network that encrypts all transaction-related information. Launched on July 28, Ironwood replaced the previous Orchard pool after the discovery of a bug that could have allowed the creation of fake coins. Although investigators can still see funds entering and exiting the pool, they cannot track internal operations.
Investigations Point to North Korea
Bitget's CEO, Gracy Chen, stated that IP addresses and attack patterns match those used by North Korean hackers. Blockchain analysis firm Elliptic considers it "highly likely" that North Korea is involved, classifying the theft as the largest suspected attributable to Pyongyang in 2026, bringing the annual total over $1 billion.
The Dynamics of the Theft and the Attempt to Launder
The attack began on September 24 when Bitget's systems detected unauthorized transfers from the exchange's hot wallets. According to Chen, the aggressors turned on the backend systems and falsified transaction data rather than stealing private keys. Bitget stated that its protection fund will cover the damages, ensuring that customer balances remain unchanged.
Laundering Through Cross-Chain Swap Services
The attacker split the stolen funds into new wallets containing round amounts, such as 10,000 ETH or 20 million XRP each. TRM Labs detected that smaller portions were sent through cross-chain swap services like Thorchain, Across, Bridgers, Chainflip, and FixedFloat, tools that complicate the tracking of transactions.
The Contrasting Responses of Near Intents and Thorchain
Near Intents blocked over $50 million in swaps linked to the attacker, with $503,000 frozen during transactions and about $166,000 that managed to pass. The blocked funds will be subject to legal and recovery procedures. In contrast, Thorchain refused Bitget's request to block the attacker's addresses, stating that halting the network is an emergency tool to protect the protocol, not a method to freeze specific transactions.
The Controversy Over Permissionless Architecture
Thorchain's decision reignited the debate over blockchain's permissionless architecture. Illia Polosukhin, co-founder of Near, argued that such architecture does not obligate every application to process all transactions. However, Thorchain previously halted the entire network for about five weeks after an attack on May 15, 2026, which resulted in the loss of $10.7 million from liquidity pools, according to its quarterly report.
Swap Operations Continue
Despite the blocking measures, the attacker's transactions continued. On Monday, several batches totaling approximately 2,390 ETH, worth $6.3 million, were converted into 75.2 BTC through Thorchain, as shown by on-chain data. Bitget offered a 5% reward on frozen funds and another 5% on recovered funds, excluding actions ordered by courts or law enforcement.
The Importance of AML Compliance for Exchanges
This incident underscores the need for exchanges to implement robust crypto AML compliance and exchange KYC measures. The ability to track and block suspicious transactions is crucial to preventing money laundering through cryptocurrency platforms. Exchanges should consider adopting advanced managed SOC and MDR solutions to improve operational security.
Protecting User Funds
The episode also highlights the importance of institutional crypto custody solutions to protect user funds. Exchanges should consider using institutional custody services to ensure that user funds are safe from similar attacks. Additionally, creating protection funds, like Bitget's, can provide an extra layer of security for users.
The Impact on Exchange Reputation
Attacks like the one suffered by Bitget can have a significant impact on an exchange's reputation. It is essential for cryptocurrency trading platforms to demonstrate transparency and accountability in handling such incidents. Implementing effective breach remediation and incident response measures can help restore user trust.
The Need for Improvements in Blockchain Security
This event underscores the need for continuous improvements in blockchain security. Developers should collaborate with cyber insurance and cybersecurity experts to identify and mitigate vulnerabilities in existing protocols. Adopting managed security operations center practices can help prevent future attacks.
The Challenge of Tracking Stolen Funds
The transfer of stolen funds to Zcash's Ironwood pool represents a significant challenge for investigators. The privacy-focused nature of Zcash makes it difficult to track fund movements within the pool. This incident highlights the importance of developing advanced Data Loss Prevention and Security Information and Event Management tools to monitor and prevent money laundering through private blockchains.
The Importance of International Collaboration
The possible connection with North Korean hackers underscores the importance of international collaboration in combating cybercrime. Authorities and cryptocurrency companies should work together to share information and coordinate efforts to recover stolen funds. Adopting NIS2 compliance and DORA regulation standards can facilitate this collaboration.
The Response of Regulatory Authorities
Incidents like Bitget's can push regulatory authorities to strengthen cryptocurrency security regulations. Companies should prepare to meet NIS2 adequacy and digital operational resilience requirements, ensuring that their operations comply with new laws.
The Impact on the Cryptocurrency Market
The attack on Bitget generated shockwaves across the cryptocurrency sector, with a temporary 3.2% drop in trading volume on centralized exchanges. According to CoinGecko, the overall market lost $45 billion in capitalization in 48 hours, although Bitcoin managed to maintain support above $55,000. This episode has accentuated the perception of risk for institutional investors, who are re-evaluating their crypto asset management strategies.
The Challenges for Financial Investigators
Experts in crypto AML compliance face an unprecedented challenge. Shielded pools like Ironwood represent a significant obstacle to tracking illegal financial flows. According to Chainalysis, about 20% of funds stolen by state actors are currently being transferred to privacy-focused pools, making recovery extremely difficult. This phenomenon is pushing authorities to explore new forms of exchange KYC for cross-chain transactions.
The Implications for End Users
For individual traders, this incident underscores the importance of adopting rigorous crypto taxation Italy practices. The complexity of laundering through shielded pools and cross-chain swap services makes specialized crypto accountant advice crucial. Additionally, users should consider using cold storage wallets and institutional crypto custody solutions to protect their assets.
The Evolution of the Regulatory Landscape
The European Union is accelerating the implementation of the MiCA regulation, with particular attention to crypto AML compliance. The NIS2 directive and the DORA regulation are creating a stricter regulatory framework for exchanges and critical service providers. Companies will need to invest in NIS2 adequacy and digital operational resilience to avoid sanctions and ensure operational continuity.
Technological Innovations in Response to Attacks
In response to these incidents, cybersecurity companies are developing new solutions to monitor and prevent money laundering through private blockchains. Security Information and Event Management (SIEM) and Data Loss Prevention (DLP) technologies are evolving to include modules specific to cryptocurrencies. Additionally, the adoption of zero trust architecture and identity access management (IAM) can reduce the risk of unauthorized access to backend systems.
Fund Recovery Strategies
Bitget has implemented a breach remediation strategy that includes collaboration with international authorities and the use of advanced incident response techniques. The 5% reward on recovered funds represents a significant incentive for independent investigators. However, the success of these operations will depend on the ability to track funds within shielded pools and through cross-chain swap services.
The Impact on Cyber Insurance
The increase in attacks on exchanges is affecting the cyber insurance market. Cyber insurance policies are becoming more expensive and complex, with specific clauses for cryptocurrency attacks. Companies should consider adopting customized cyber risk policy and investing in ransomware protection and ransomware recovery to mitigate risks.
The Future Prospects of the Sector
The cryptocurrency sector is maturing rapidly, with an increasing focus on security and regulatory compliance. Exchanges that invest in crypto AML compliance, exchange KYC, and managed security operations center will be better positioned to face future challenges. Additionally, the adoption of advanced Data Loss Prevention and Security Information and Event Management technologies will be crucial to preventing similar attacks in the future.
The Need for Global Collaboration
The fight against cybercrime requires global collaboration among authorities, companies, and technical communities. The adoption of international standards for NIS2 compliance and DORA regulation can facilitate information sharing and coordination of recovery operations. Additionally, the creation of task forces specialized in crypto AML compliance and exchange KYC can improve the effectiveness of investigations.
Lessons Learned from the Bitget Attack
The Bitget attack offers important lessons for the cryptocurrency sector. Exchanges must adopt advanced security measures, such as managed SOC and MDR, to prevent similar attacks. Additionally, creating protection funds and offering rewards for fund recovery can help mitigate the impact of incidents. Finally, transparency and accountability in managing incidents are essential to maintaining user trust.
The Importance of Training and Awareness
Training and awareness are fundamental to preventing cyberattacks. Exchanges should invest in training programs for their employees and promote awareness among users. Additionally, collaborating with cybersecurity and crypto AML compliance experts can help identify and mitigate vulnerabilities in existing protocols.
Prospects for Institutional Investors
Institutional investors are re-evaluating their crypto asset management strategies in response to attacks on exchanges. The adoption of institutional crypto custody and institutional custody solutions can reduce the risk of losses due to cyberattacks. Additionally, diversifying investments and using crypto taxation Italy tools can help manage the risks associated with the cryptocurrency sector.
The Challenges for Blockchain Developers
Blockchain developers face significant challenges in designing secure protocols. The adoption of managed security operations center and zero trust architecture practices can help prevent cyberattacks. Additionally, collaborating with cybersecurity and crypto AML compliance experts can improve the security of existing protocols.
The Implications for the Insurance Market
The Future Prospects for Cryptocurrencies
Despite the challenges, the cryptocurrency sector continues to grow and evolve. The adoption of advanced Data Loss Prevention and Security Information and Event Management technologies can help prevent cyberattacks. Additionally, collaboration among authorities, companies, and technical communities can improve the security and regulatory compliance of the sector.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.