Bitget attacker moves 2,700 ZEC to Zcash Ironwood after Near SHIELD rejects $50M in swaps

The attacker behind the $387.5M Bitget heist has begun shielding funds through Zcash's Ironwood pool after Near Intents blocked cross-chain swaps, on-chain investigator ZachXBT reported and Decrypt confirmed on September 30. Approximately 2,700 ZEC (~$3.8M) has moved into Ironwood so far, according to ZachXBT's timeline picked up by Cryptopolitan and Crypto Times.

What happened

• Near Intents rejected the swaps. Near Intents' screening system, called SHIELD, flagged transactions tied to the Bitget attacker addresses. General manager Alex Shevchenko told Decrypt SHIELD "rejected more than $50 million in swaps" tied to the attacker. Around $503,000 was frozen mid-swap; roughly $166,000 slipped through before flags applied.
• Attacker rerouted to Zcash. With Near closed, the operator began converting into ZEC and depositing into Ironwood, a shielded pool that breaks the on-chain trail once funds settle inside.
• This is not the first ZEC leg. Earlier tranches had moved through Zcash before Ironwood — around 18,900 ZEC (~$28.3M) had reportedly transited earlier ZEC hops before this Ironwood batch, per Crypto Times summarizing ZachXBT's tracking.

Mechanism — Ironwood

Ironwood is a shielded pool on Zcash: once ZEC is deposited, its subsequent movement is proved with a zero-knowledge proof but no address, amount or timing is revealed on the transparent chain. Analysts can see coins go in; they cannot follow them once in. It is the same laundering property Tornado Cash offered for ETH-denominated flows before the OFAC designation, applied to Zcash liquidity.

The SHIELD system Near operates is different: rather than block a token's transferability, it inspects swap intents for tainted counterparties and refuses to route them. That gives Near Intents a compliance-adjacent property most cross-chain routers lack, but only for the paths that pass through its solver network — the attacker can, and did, walk around it.

Attribution — hedged

• Elliptic: characterizes a North Korean link as "highly likely," per its September attribution report, and ranks the Bitget heist as the largest suspected DPRK-linked theft of 2026.
• Bitget CEO Gracy Chen: said "the attack's IP addresses and pattern match North Korean hackers." Executive statement, not government finding.
• No government has publicly attributed the heist at the time of writing. Neither the FBI's IC3 nor OFAC has issued a designation.

Following our standard, we report the attribution as claimed by named analytics firms rather than as fact.

What to watch

1. Further Ironwood deposits. ZachXBT's tracking is public; if the outflow rate on the attacker's transparent-Zcash wallets increases, larger tranches are likely still to shield.
2. Which routers stop routing next. Thorchain, Chainflip, deBridge and Across all have solver systems the attacker could try. Public statements from any of them on freezing or filtering flows would matter.
3. Bitget's insurance drawdown. The exchange said its $300M protection fund held ~$464M before the attack. It has not yet published a public accounting of how much of the loss it will absorb.

Context — a pattern

The playbook Elliptic describes here is consistent with prior centralized-exchange hot-wallet drains attributed to North-Korea-linked actors: initial access through a third-party dependency, custom withdrawal tooling that produces transactions the exchange's own controls accept as valid, and immediate cross-chain laundering — increasingly routed through Zcash's shielded pools rather than Ethereum mixers, whose Tornado Cash sanctions history has raised the compliance cost of routing large ETH-denominated flows through them.

The primary sources for this post are ZachXBT's on-chain trail — public in his tracker — Elliptic's attribution analysis, and the Decrypt / Crypto Times / Cryptopolitan coverage that timed it to Ironwood.