- ZachXBT says about 2,700 ZEC, worth roughly $3.8 million, was sent into Ironwood.
- He flagged 3 deposit transactions and what appears to be the source address of the theft.
- Shielding makes transactions inside Ironwood difficult to trace, limiting visibility.
According to blockchain investigator ZachXBT, hackers believed to be linked to North Korea have begun shifting some of the Zcash taken in the September 24 Bitget hack into Zcash’s Ironwood shielded pool.
ZachXBT says about 2,700 ZEC, worth roughly $3.8 million, was sent into Ironwood. That’s part of the roughly 18,900 ZEC (about $28.3 million) allegedly stolen from a Bitget hot wallet in the attack. He also flagged three deposit transactions and what appears to be the theft’s source address.
The development is notable because the stolen ZEC was first held in transparent Zcash addresses where transactions work a lot like Bitcoin, meaning addresses, amounts, and transfers are visible to anyone.
However, Zcash’s privacy is optional. When transparent ZEC gets moved into a shielded pool like Ironwood, transactions inside that pool use zero-knowledge proofs to hide the sender and recipient.
So the act of shielding is still visible, as investigators can see ZEC going from a transparent address into Ironwood, along with the amount and when it happened. What gets much harder is following what happens inside the pool after that.
Interestingly, Ironwood is Zcash’s newest shielded pool, and it arrived with the NU6.3 upgrade on July 28, 2026, after a flaw was found in the previous Orchard pool. Zcash says Ironwood was built to boost security and allow anyone to independently verify the integrity of the circulating supply.
Can Investigators Still Trace Stolen ZEC Inside Ironwood?
Still, investigators may not be without leads.
Law enforcement and blockchain analytics firms can keep the transparent trail leading up to Ironwood. They can watch for funds moving back out of the shielded pool and monitor any contact with exchanges, custodians, or other known services where the money could be frozen or linked to someone’s account.
As such, investigators can piece together blockchain evidence with exchange records and other data. If the stolen ZEC eventually ends up at a regulated service that requires ID verification, that could give authorities another point where the money becomes traceable or freezable.
Related: Bitget Exploit: What Happened to $351.6M and Are User Funds Safe?
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
