Suspected North Korean hackers have hidden about 1% of Bitget's $387.5 million loss in Zcash
Suspected North Korean hackers have moved $3.8 million of Bitget's $387.5 million into Zcash's shielded pool, about 1% of the haul. About $24 million of stolen ZEC remains in transparent addresses that exchanges and police can still freeze.
The Investor · Invest desk
What happened
- The attackers used a zero-day in a third-party security product Bitget had run for weeks to trick its approval process, without touching cold storage or private keys.
- XRP was the largest stolen asset at about $157 million, with ETH, USDT, USDC, ZEC, BNB, AVAX and TRX also taken across four networks.
- CEO Gracy Chen attributed the attack to North Korea-linked actors, citing behavioral patterns and IP addresses that match earlier DPRK hacks.
- Bitget suspended withdrawals soon after it detected the breach and began phasing them back in during late September.
Why it matters
- What it costs cost The loss is paid from Bitget's User Protection Fund, so customers are made whole and the exchange goes into any second incident with a smaller reserve.
- What it limits constraint Exchanges built their deposit screens to flag coins that touched Tornado Cash, sanctioned since 2022. Those screens have less to catch when the shielding is part of Zcash itself.
- Who's exposed exposure Any exchange running the same third-party security product is open to the same manipulation of its approval process until the zero-day is fixed.
Next story · Invest · Oct 3
Issuers and protocols have frozen about 0.2% of the $387 million taken from BitgetConfirmed3 publishers
On the coins taken so far, Zcash can hide at most the Zcash the attackers took. According to Crypto Briefing, they received about 18,900 ZEC from the exploit, worth roughly $28 million [3]. That is about 7% of the $387.5 million total [13]. The publication ranks the theft as the largest single crypto theft of 2026 [2]. The other 93% is in other tokens on other networks [8], and the account does not report where those coins have gone.
Inside the Zcash slice, the laundering is moving faster. About 2,700 of the 18,900 ZEC, roughly one coin in seven [14], was in the Ironwood pool by September 30, about six days after the breach [1]. Six days is the longest the move could have taken, so the rate was at least 450 ZEC a day [19]. At that minimum rate the remaining 16,200 ZEC would be in the pool within about five weeks [19]. Once the coins are shielded, only the sender's private viewing key can link them to the theft [17]. Until then they sit in transparent addresses, where exchanges and law enforcement can still freeze or blacklist them [4].
Bitget carries the cash cost. The exchange says its User Protection Fund held over $464 million at the time of the attack and is enough to repay customers in full [11]. Paying out $387.5 million would leave at least $76.5 million [15]. Against the first loss estimate of $351.6 million [7], the spare would have been at least $112.4 million. The review that added $35.9 million to the loss therefore took roughly a third off that cushion [16].
In my view, the Zcash laundering covers a $28 million slice of a $387.5 million theft [13]. Freezes on the transparent ZEC would keep the shielded share near the 1% already moved [12]. If the rest reaches Ironwood untouched, the share rises to about 7% [13]. The counter-case is that the attackers chose Zcash because it works for them [18], and that they can swap the other tokens into ZEC and shield those as well. On-chain evidence of that swap would prove this view wrong.
What to watch
- Freeze or blacklist notices on the transparent ZEC addresses before the rest of the coins reach the Ironwood pool.
- Whether the third-party security vendor is named, and whether other exchanges disclose that they ran the same product.
- A Bitget statement on how much the User Protection Fund actually paid out and what balance it holds afterwards.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+12
- Incentives50
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
By September 30, roughly six days after the breach, about 2,700 ZEC worth $3.8 million had been routed into Zcash's Ironwood shielded pool.
- [2]
Attackers linked to North Korea reportedly siphoned approximately $387.5 million from the Seychelles-based exchange Bitget on September 24, the largest single crypto theft of 2026.
- [3]
Attackers received approximately 18,900 ZEC from the exploit, valued at around $28 million.
- [4]
Roughly $24 million in ZEC remains in transparent addresses; if attackers move it into shielded pools before exchanges and law enforcement can freeze or blacklist the coins, recovery becomes extraordinarily difficult.
- [5]
Bitget CEO Gracy Chen attributed the attack to DPRK-associated actors, citing behavioral patterns and IP addresses consistent with previous North Korea-linked hacks.
- [6]
Investigators traced the root cause to a zero-day exploit in a third-party security product Bitget had used for several weeks, which let attackers manipulate transaction data and trick the exchange's internal approval process without touching cold storage or private keys.
- [7]
Bitget's initial damage estimate was $351.6 million, later raised to $387.5 million once the full scope of compromised wallets became clear.
- [8]
XRP was the largest stolen asset at roughly $157 million; the rest included ETH, USDT, USDC, ZEC, BNB, AVAX and TRX across Ethereum, the XRP Ledger, Zcash and TRON.
- [9]
Bitget's security team first flagged the unauthorized activity at around 18:31 UTC.
- [10]
Bitget suspended withdrawals shortly after detecting the breach and began phasing them back in during late September.
- [11]
Bitget pointed to its User Protection Fund, which held over $464 million at the time of the incident, as sufficient to cover customer losses in full.
- [12]
The $3.8 million shielded is about 1% (0.98%) of the $387.5 million stolen.
- [13]
The roughly $28 million of stolen ZEC is about 7% of the $387.5 million theft; the other roughly 93% is in other tokens.
- [14]
About one in seven of the stolen ZEC had been shielded by September 30.
- [15]
Paying the $387.5 million loss from a fund of over $464 million leaves at least $76.5 million.
- [16]
At the first $351.6 million estimate the fund's spare would have been at least $112.4 million; the $35.9 million upward revision took about 32% off it.
- [17]
Zcash shielded transactions encrypt sender, receiver and amount; once funds enter a shielded pool, linking them to their origin is for practical purposes impossible without the sender's private viewing key. Transparent transactions are visible to anyone with a block explorer.
- [18]
The choice of Zcash over routes like Tornado Cash suggests the attackers are adapting; Tornado Cash has faced OFAC sanctions since 2022 and many exchanges flag deposits that touch it, while Zcash's shielding is built into the protocol itself.
- [19]
Shielding 2,700 ZEC within at most six days implies at least 450 ZEC a day; at that rate the remaining 16,200 ZEC would be shielded within about 36 days, roughly five weeks.
Sources
2 independent publishers whose own reporting we read for this story.
- coindesk.comBitget hackers move $4 million into Zcash’s private pool, making funds harder to trace
1 article · September 30, 2026
- cryptobriefing.comBitget funds reportedly shielded through Zcash after breach
1 article · September 30, 2026