Lazarus Group starts laundering Bitget exploit funds via Zcash
Security & Exploits ·
Attackers linked to the Lazarus Group have begun moving a portion of the $28.3M drained from a Bitget hot wallet through Zcash's shielded pool, in a bid to obscure the funds' trail.
According to wublockchain.xyz, DPRK-linked actors have started routing roughly $3.8M of the stolen funds through Zcash's Ironwood shielded pool, a privacy feature designed to hide transaction details on the network. The amount moved so far corresponds to about 2,700 ZEC, a fraction of the total $28.3M taken in the September 2026 exploit of the Bitget hot wallet.
Shielded pools like Ironwood work by encrypting sender, receiver, and amount data for transactions routed through them, making it substantially harder for chain-analysis tools to trace funds once they enter the pool. For actors attempting to launder large sums stolen in an exploit, this provides a way to break the on-chain link between the original theft and any funds that later resurface on exchanges or other services.
The move follows a pattern associated with the Lazarus Group, which has previously used a mix of bridges, mixers, and privacy-preserving protocols to obscure proceeds from prior thefts before attempting to cash out. The choice of Zcash's Ironwood pool specifically points to a deliberate effort to exploit one of the few widely used privacy tools still available to move significant value without immediate visibility.
Multiple reports have converged on the same set of figures, with the $28.3M total exploit size and the $3.8M initial tranche moving into Ironwood cited consistently across the cluster of corroborating accounts. The consistency in the numbers suggests the laundering activity is being tracked in close to real time as it unfolds, though the reports do not indicate how much of the remaining roughly $24.5M has moved or is expected to move through similar channels.
What remains unclear is the ultimate destination of the shielded funds once they exit the Ironwood pool, whether exchanges will be able to flag or freeze any downstream transfers, and how much of the total $28.3M will eventually be successfully obscured versus recovered or traced. Investigators and blockchain monitoring groups are likely to continue watching wallet activity tied to the Bitget exploit for further movements into or out of privacy pools in the coming days.