Hackers Move Stolen Crypto Into Zcash Shielded Pools

On-chain investigators have identified suspected stolen cryptocurrency moving into Zcash (ZEC), linking funds to three separate security incidents involving Bitget, Cryptobills Ledger, and Triple-A, according to CryptoNews.

Blockchain analyst Specter reported on October 17 that funds associated with the Cryptobills Ledger incident and a $12 million Triple-A exploit entered Zcash. The report builds on earlier findings by investigator ZachXBT, who traced approximately 2,700 ZEC—valued at roughly $3.8 million at the time—into Zcash’s Ironwood shielded pool following a breach at exchange Bitget.

Multi-Incident Fund Movements

The findings highlight activity involving multiple threat actors transferring stolen assets into Zcash. Bitget confirmed total losses of approximately $387.5 million from its September 24 security incident, which compromised portions of its hot and warm wallet infrastructure across several blockchains, including Zcash, Ethereum, TRON, and XRP Ledger.

Specter noted that while funds from Cryptobills Ledger and Triple-A were observed entering Zcash, complete public transaction trails establishing exact values for those two incidents were not published. ZachXBT separately identified about 18,900 ZEC, worth $28.3 million at the reported valuation, among assets linked to the Bitget breach.

Privacy Pools and Protocol Updates

Zcash allows users to conceal transaction details, hiding senders, recipients, and amounts once assets enter its shielded pools. The Ironwood shielded pool was introduced during a July 28, 2026 network upgrade to replace the Orchard pool after developers discovered a vulnerability that could have permitted counterfeit coins to circulate.

While public records allow investigators to track initial deposits into Zcash's shielded pools, external observers cannot determine where assets move after shielding. The allegations involve actors using existing protocol privacy features, rather than a security flaw in the Ironwood protocol.

Key facts

• Investigators linked stolen funds from Bitget, Cryptobills Ledger, and Triple-A to Zcash transactions.
• ZachXBT traced 2,700 ZEC ($3.8 million) into Zcash's Ironwood shielded pool following Bitget's breach.
• Bitget confirmed its overall September 24 incident losses reached $387.5 million across multiple networks.
• Zcash activated its Ironwood upgrade on July 28, 2026, to introduce updated cryptographic protections.