Summary
The DPRK-linked hackers responsible for the Bitget breach have moved approximately $4 million in stolen assets into Zcash’s shielded transaction pool, where funds become cryptographically untraceable even to blockchain analytics firms. SlowMist has separately published on-chain analysis tracing the breach origin to August 31, 2026, when a zero-day in the third-party security product used by Bitget was first exploited — meaning attackers had access for approximately 23 days before executing the theft.
Timeline
| Date | Event |
|---|---|
| August 31, 2026 | SlowMist identifies zero-day exploitation of third-party security product; attackers establish initial access |
| Sep 23-24, 2026 | Bitget hack executed; $387.5 million stolen |
| Sep 24-29, 2026 | Circle/Tether freeze $36M; Near Intents blocks $50M; XRP and THORChain movements |
| Sep 29-30, 2026 | $4M moved into Zcash shielded pool; SlowMist publishes Aug 31 trace; CoinDesk and Cryptoslate report |
What Changed
The Zcash shielded pool movement is qualitatively different from prior laundering steps. XRP movement, THORChain ETH swaps, and Near Intents-blocked attempts all involved assets traceable on public blockchains. Zcash’s shielded pool uses zero-knowledge proofs to make transaction amounts and addresses cryptographically private. Once assets enter the shielded pool, blockchain analytics firms including Chainalysis and Elliptic cannot trace their movement or destination. The $4 million represents the first confirmed movement of Bitget stolen assets into a genuinely untraceable state.
SlowMist’s August 31 origin trace establishes a 23-day dwell time before the theft — consistent with DPRK attack patterns involving extended reconnaissance and staging. During that window, attackers had the opportunity to map Bitget’s internal systems and pre-position withdrawal addresses. Any forensic investigation must examine activity back to August 31.
Domain Intelligence
bitget.com — 61.92
Score unchanged. bitget.com scores in the low-trust range at 61.92.