Zcash today: 2,746 ZEC from the Bitget hack vanish into the Ironwood pool

Part of the haul from the break-in at the exchange Bitget has been untraceable since Wednesday morning. Over the course of the morning, 2,746 ZEC moved in three transfers into Ironwood, the newest shielded pool on Zcash. At Wednesday midday prices that is roughly $3.9 million, and about 15 percent of the ZEC that left the exchange on September 24. For your own holdings nothing follows from this for now: anyone who holds ZEC in their own wallet is untouched by these transfers. The practical question sits elsewhere, and it concerns everyone who buys or sells ZEC through an exchange account.

The movement was reported by the pseudonymous blockchain investigator ZachXBT, who made the three transfers public on Wednesday through his Telegram channel. CoinDesk then traced them through the transaction data. According to the same report, the funds arrived by way of two intermediate addresses, fed from a wallet that Bitget itself had attributed to the attacker.

2,746 ZEC in three transfers: the route into the Ironwood pool

The figures sit close together but come apart slightly depending on the source. CoinDesk names 2,746 ZEC in three deposits and roughly $3.9 million. Cryptobriefing speaks of about 2,700 ZEC and roughly $3.8 million. Both houses are counting the same event, only at slightly different price levels and with different rounding. So take the range: between 2,700 and 2,750 ZEC, between $3.8 million and $3.9 million.

The totals for the stolen ZEC differ marginally as well. CoinDesk arrives at about 18,917 ZEC, Cryptobriefing at around 18,900 ZEC worth roughly $28 million. In both cases the shielded portion works out to about the one seventh that the reports put at 15 percent.

The order of events matters here. After the break-in, the ZEC sat on ordinary addresses that anyone could inspect. Only the step into Ironwood changes the picture, and so far it covers a small part of the sum.

What separates a transparent address from a shielded one

Zcash knows two kinds of address. A transparent address works like a Bitcoin address: amount, sender and recipient sit openly in the chain and any observer can read them. A shielded address belongs instead to what is called a shielded pool, in which exactly those three details are encrypted. As long as a balance stays inside the pool, all an outsider can see is that something went in.

Shielded pool explained: Ironwood hides sender, recipient and amount

A shielded pool is an encrypted area inside the same blockchain, where transfers do take place and are cryptographically verified, but their particulars are not publicly visible. Ironwood, as CoinDesk describes it, is the newest of these areas on Zcash. Transfers inside the pool conceal sender, recipient and amount at the same time.

Zcash has renewed these areas several times over the years; Ironwood is the most recent, and older pools continue to exist alongside it. For the present case only one property counts: once an amount sits in the pool, the chain itself no longer offers any way to tie it back to its origin.

This is neither a bug nor a loophole. It is the stated purpose of the technology. Zcash launched in 2016 explicitly as a currency with encrypted payment data. The same property that hides a salaried worker's pay also hides an attacker's source of funds.

Why 15 percent of the ZEC haul is enough to break the trail

With stolen crypto assets, investigators normally work with the chain itself: follow a sum from address to address, spot splits and merges, and wait until a partial amount lands at an exchange that knows its customers. That is the point where money can be frozen. How well this works has already been shown in this case: another protocol says it froze $50 million from the same haul before it could drain away.

Inside the shielded pool that method breaks off. There is no follow-on address to observe and no amount to recognise again. The trail is not entirely lost, though. CoinDesk points out that on a later return to transparent addresses, investigators can pick up timings, amount sizes and other side data. Within the pool, Zcash gives up no transaction path of its own accord.

For those involved this turns into a race. Every amount still lying in the open can surface at a service provider and be stopped there. Every amount that has been shielded is beyond that reach for the time being.

Roughly $24 million still sits on transparent addresses

The rest of the ZEC remains visible, according to the Cryptobriefing report: about $24 million on transparent addresses, as of Wednesday's reporting. That is by far the larger share, and it stays observable. Whether it takes the same route is open; the only documented move so far is the one from Wednesday morning.

This split also explains why the report carries weight despite the comparatively small amount. The weight does not sit in the sum. It sits in the proof that the route into the shielded store is open and is being used.

The September 24 break-in: $387.5 million through a zero-day flaw

The incident these ZEC come from lies six days back. On September 24, according to the available reports, $387.5 million left wallets of the Seychelles-based exchange Bitget. The reports name a zero-day flaw in a bought-in security product as the cause, combined with compromised internal credentials through which withdrawal instructions could be triggered.

A zero-day flaw is a weakness known to the attackers but not yet to the manufacturer, so that at the time of the attack no fix exists. The location of the flaw is notable: a supplied product, not the exchange's own code. A trading venue's attack surface therefore does not end at its own software.

The largest single item, according to Cryptobriefing, was XRP at roughly $157 million, followed by ETH, USDT, USDC, BNB, AVAX and TRX. At about $28 million the ZEC make up a smaller share, but they stand at the centre now because only they offer the shielded escape route.

We have gathered the figures on how the exchange handled the damage, and on customer outflows in the days that followed, in a separate piece. Bitget itself says the loss is covered by its own protection fund, which it puts at more than $464 million.

Gracy Chen attributes the attack to North Korean actors

The attribution comes from the exchange itself. Bitget chief executive Gracy Chen traces the attack to actors with ties to North Korea, citing behavioural patterns and IP addresses that she says match earlier attacks with a North Korean connection. ZachXBT places the attackers in the same direction.

This is an assessment by the injured party and by an investigator, not a judicial or official finding. No independent confirmation exists so far, and the actors named are not identified individually. For judging the event the question of origin changes little in any case: the technical sequence and the consequences for traceability are the same.

Article 79 of the EU anti-money-laundering regulation takes privacy coins off exchanges

For you as an investor in Europe the case has a follow-on that reaches beyond the news itself. The EU anti-money-laundering regulation, Regulation (EU) 2024/1624, applies from July 10, 2027. Its Article 79 forbids the firms it covers to keep accounts that obscure the holder or the transactions, and it names crypto assets with increased anonymity explicitly.

In practice that means regulated providers in the EU will no longer be allowed to offer ZEC and comparable assets. We have taken apart what exactly falls away and what remains in our piece on the EU trading ban for Zcash. Some houses have moved ahead of the deadline: Binance removed Monero from its range, citing its regulatory alignment, and Kraken restricted access to comparable assets in the EU.

What a CASP is and why the term counts here

CASP stands for crypto-asset service provider, that is a provider of crypto-asset services licensed in the EU. Every exchange, every broker and every custodian you can legally use in Europe falls under it. The duties from Article 79 apply to exactly these firms, not to you as a private individual. If you want to compare which houses work under European supervision, our overview of regulated crypto exchanges helps.

ZEC at 1,284 euros: down 13.8 percent in seven days

The price has barely reacted to the report so far. ZEC trades at Wednesday midday at 1,284 euros, or $1,460, up about one percent within a day. Over a week, by contrast, it stands at a loss of 13.8 percent, measured in dollars. That puts Zcash at rank nine by market capitalisation.

No link between the shielding and the price can be derived from these figures. The weekly loss set in before Wednesday's report, and 2,746 ZEC is small relative to daily trading volume. If you want to keep the price in view, read the shielding as news about traceability, not as a supply or demand signal.

Exchanges treat ZEC deposits from shielded addresses more strictly

Here is where the case touches you in practice. Many trading venues check incoming payments for where they came from. A deposit whose history cannot be reconstructed is hard for a compliance department to place, and a shielded balance is exactly that. Some houses therefore do not accept deposits from shielded addresses at all; others demand proof of origin before they release the balance.

From this follows a plain precaution that has nothing to do with this attack and still becomes visible through it: if you want to transfer ZEC to an exchange, establish beforehand which address type your payment comes from and whether your provider accepts it. And if you withdraw ZEC from an exchange, note the transaction with date and amount while the exchange still shows you the data. For documenting the purchase and sale dates you need for the holding period, there are tax and portfolio tools that record them automatically.

Self-custody stays legal, the exchange listing does not

A common misunderstanding belongs cleared up at this point. The EU rule from July 2027 does not forbid you to own Zcash. What is prohibited is for regulated providers to keep carrying it. Holding it, storing it yourself and transferring it directly to another person all remain permitted. What falls away is the convenient route through an account at a European provider.

Anyone who wants to keep ZEC beyond 2027 therefore ends up almost inevitably at self-custody. Which device is suitable, which models support Zcash at all and what they cost is set out in our hardware wallet comparison. Support for shielded addresses is the important part: not every device and not every wallet application can handle them, and a device that only knows transparent addresses strips away the very property Zcash is about.

The timeframe is generous. July 2027 is more than 21 months away, and there is no cause for haste. There is cause not to leave the move to the final weeks, because then everyone arrives at once.

Zcash and the Ironwood pool: How to proceed now

1. Establish where your ZEC sits and in which address type. A balance on an exchange account belongs to you only as a claim against the exchange, and it is exactly that claim that falls under the rule from July 2027. If you want to switch to self-custody, check in the hardware wallet comparison which device supports shielded Zcash addresses.
2. Look up which supervision your provider operates under. Anyone already with a firm licensed in the EU learns of restrictions early and in an orderly way, usually with deadlines and an option to convert. The overview of regulated crypto exchanges shows who belongs to that group.
3. Secure your purchase records before you move anything. For the one-year holding period under Section 23 of Germany's Income Tax Act, the acquisition date counts, and a move into your own wallet is not a sale. You still have to be able to prove it, which is why a tax and portfolio tracker should read in the data before the move.

What remains from Wednesday is evidence and not conjecture: the route into the shielded store is open, it is being used, and it removes the affected amount from tracing over the chain. The larger part of the stolen ZEC still sits in plain view. For your own holdings nothing changes today; for the question of where you hold ZEC in two years, a great deal does.

Sources to read up on: the report by CoinDesk on the three transfers and the text of Regulation (EU) 2024/1624 with Article 79.

(As of September 30, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)