Investigators Report Suspected Hack Proceeds Moving Into Zcash
Investigators have linked funds from three separate crypto incidents to Zcash, where shielded transactions can make later movements harder to trace. A reported amount is available for the Bitget-related deposit, but claims involving Cryptobills Ledger and Triple-A are less fully documented. Onchain data shows hackers moving stolen funds to Zcash.
- Bitget: ZachXBT reported about 2, 700 ZEC entering Zcash’s Ironwood pool.
- Two other incidents: Specter reported suspected transfers but gave no complete transaction trail or amounts.
- Key limit: Tracing funds to a shielded pool does not necessarily reveal where they go next.
- No reported Ironwood exploit: The claims concern suspected use of privacy features, not a newly disclosed protocol flaw.
On October 17, analyst Specter posted on X that funds linked to the Cryptobills Ledger incident and the $12 million Triple-A exploit had entered Zcash. The post’s year was not specified. Specter did not publish a complete transaction-level trail or establish how much from either incident reached the network. The transfers remain allegations, not a fully documented public accounting.
The claims also do not show that the same people carried out all three incidents. Available information does not establish whether the suspected actors used the same addresses or coordinated their movements. There is little detail about the Cryptobills Ledger incident or the mechanics of the Triple-A exploit.
What the Bitget tracing shows and what it doesn’t
On September 30, 2026, blockchain investigator ZachXBT said wallets allegedly associated with the Bitget attackers had transferred approximately 2, 700 ZEC into Zcash’s Ironwood shielded pool. He valued the amount at roughly $3.8 million at the time. ZachXBT separately identified approximately 18, 900 ZEC, valued at $28.3 million, among assets associated with the Bitget incident. That larger figure is not the amount reported as deposited into Ironwood, and the two valuations are not from a single price snapshot. Bitget hackers move $4 million into Zcash’s private pool.
These figures come from investigators and do not prove that every asset in the broader estimate entered Zcash. Linking funds to a theft depends on the tracing and analysis connecting wallets to the incident. A deposit into a shielded pool alone does not establish who owned the funds beforehand.
Zcash’s shielded transactions hide details such as the sender, recipient and amount from public blockchain observers. Investigators may be able to follow funds to a shielded deposit, but the public record may not reveal later shielded movements. Funds can become visible again if they move to transparent addresses, so a shielded deposit does not make every future movement untraceable.
Ironwood is not the alleged vulnerability
Zcash activated Ironwood through a network upgrade dated July 28, 2026, after a vulnerability was discovered in its older Orchard system. The upgrade restricted transfers from the older pool and introduced updated cryptographic protections. Its stated goal was to preserve shielded transactions while allowing the circulating supply to be independently verified.
No Ironwood vulnerability has been reported in the information available here. The allegations concern suspected actors using Zcash’s privacy features to obscure the trail of funds, not a newly disclosed flaw in the pool. Ironwood was not introduced as an anti-money-laundering measure.
Bitget’s breach and other reported routes
Bitget said unauthorized transfers affected parts of its hot and warm wallet infrastructure on September 24, 2026. The exchange initially estimated the affected assets at $351.6 million, then raised its estimate to approximately $387.5 million in a September 25 update. The $35.9 million increase reflected more complete accounting, including assets on Zcash and TRON, rather than a confirmed second wave of theft.
The $387.5 million estimate covers the entire Bitget incident. It is not the amount reported as moving into Zcash.
Other tracing reports described different routes. AMLBot tracked approximately four BTC linked to the incident entering a Wasabi CoinJoin transaction. CoinJoin combines multiple participants’ inputs and outputs to make individual flows harder to identify. Separately, approximately 2, 390 ETH was reportedly converted into 75.2 BTC through 27 THORChain transactions, worth around $6.3 million at the time.
Bitget asked THORChain to restrict addresses linked to the theft. THORChain’s operators said emergency controls could suspend network activity but could not selectively block an individual user’s swap. That trade-off, between resistance to address-level censorship and limited ability to respond selectively to suspected theft, is a real challenge for decentralized systems.
Bitget resumed Bitcoin withdrawals on September 28, 2026. The exchange said its cold wallets and private keys were not compromised, customer balances remained unaffected, and its User Protection Fund would cover the financial loss. On September 30, Bitget reported that the fund had been replenished to more than $300 million. A separate September proof-of-reserves update showed a combined reserve ratio of 131% across 19 covered assets. These figures are company-reported and do not establish how much of the stolen funds has been recovered.
Key questions about the suspected Zcash transfers
-
How much Bitget-linked funds reportedly entered Zcash?
ZachXBT reported approximately 2, 700 ZEC, worth about $3.8 million at the time. The separate $387.5 million figure is Bitget’s estimate for the full incident.
-
How much from Cryptobills Ledger or Triple-A entered Zcash?
The amounts have not been established publicly. Specter reported suspected transfers but did not provide a complete transaction trail or accounting.
-
Can investigators trace funds after they enter Ironwood?
Not necessarily. Shielded transactions conceal public details, though funds may become visible again if they later move to transparent addresses. Zcash privacy claims and traceability remain under scrutiny.
-
Does this indicate a vulnerability in Ironwood?
No Ironwood vulnerability has been reported in the available information. The reported activity concerns suspected use of shielded transactions.
-
Have the funds been recovered?
Public information does not establish whether the Bitget-linked ZEC was recovered. It also does not confirm a recovery amount or final destination for the Cryptobills Ledger and Triple-A funds.
Privacy tools serve legitimate users, but they can also make stolen assets harder to trace. Here, the evidence supports a limited conclusion: investigators reported suspected deposits linked to three incidents, but the public trail is incomplete. The amounts and later destinations for two of those incidents remain unresolved. Zcash’s Ironwood upgrade and supply-risk questions are part of the broader debate over the network’s privacy protections.
