On-chain investigators have identified additional suspected stolen cryptocurrency moving into Zcash (ZEC), with funds reportedly linked to three separate security incidents involving Bitget, Cryptobills Ledger and Triple-A.
Summary
- On-chain investigator Specter linked alleged stolen funds from three security incidents to Zcash transactions recently.
- ZachXBT traced approximately 2,700 ZEC into Zcash’s Ironwood shielded pool following the September Bitget breach.
- Bitget confirmed approximately $387.5 million reached attacker-controlled addresses during its September 24 security incident investigation.
- Specter identified Cryptobills Ledger and Triple-A funds entering Zcash without publishing complete transaction-level evidence publicly.
- Zcash activated Ironwood in July 2026, creating a new shielded pool after an Orchard vulnerability.
In an October 17 post on X, blockchain analyst Specter reported that funds associated with the Cryptobills Ledger incident and the $12 million Triple-A exploit had entered Zcash, following earlier findings by investigator ZachXBT concerning assets stolen from Bitget.
The latest allegations concern the movement of stolen cryptocurrency into a privacy-focused network that allows users to conceal certain transaction details. However, Specter did not publicly provide a complete transaction trail or establish how much money from the two additional incidents had entered ZEC.
The report follows Bitget’s September security breach, which the exchange valued at approximately $387.5 million after reviewing transactions across several blockchains. Bitget’s confirmed loss figure covers the entire incident and does not represent the amount reportedly moved into Zcash.
Zcash attracts funds linked to three crypto security incidents
Specter’s findings identified activity involving funds allegedly connected to Bitget, Cryptobills Ledger and Triple-A. The analyst described multiple suspected attackers transferring cryptocurrency into ZEC after ZachXBT disclosed the use of Zcash’s privacy features in the Bitget case.
The October 17 account identified the Cryptobills Ledger security incident as one source of the suspected transfers. It separately mentioned funds from the Triple-A exploit, which reportedly involved $12 million in stolen cryptocurrency.
Neither the value of the Cryptobills Ledger transfers nor the amount attributed to Triple-A was established in the information made public. The investigation did not disclose whether the suspected actors used the same wallet addresses or coordinated their movements.
According to Specter’s account, the activity involved several threat actors. The researcher did not claim that one attacker was responsible for all three incidents.
Zcash supports transactions that can hide information about senders, recipients and transferred amounts. Its privacy technology can prevent outside observers from seeing transaction details once assets enter a shielded pool.
However, the researcher’s allegations do not establish that every reported transfer was successfully concealed or that the funds have reached their final destination.
Investigators can identify certain deposits into shielded pools, but the available public record does not necessarily reveal where the funds move afterward.
ZachXBT traces Bitget theft proceeds into Ironwood
The investigation builds on findings shared by ZachXBT on September 30 concerning cryptocurrency stolen from Bitget.
According to the investigator, wallets allegedly associated with the attackers transferred approximately 2,700 ZEC into Zcash’s Ironwood shielded pool. He valued the transfers at roughly $3.8 million at the time.
His findings followed the September 24 theft involving Bitget’s hot-wallet infrastructure. ZachXBT separately identified approximately 18,900 ZEC, worth $28.3 million at the reported valuation, among the assets associated with the incident.
The investigator provided transaction references connected to deposits into the shielded pool. Those references support tracing funds up to the identified deposit transactions but do not establish their destinations after shielding.
Ironwood is a newer Zcash shielded pool introduced through the network’s July 28, 2026, upgrade. It uses technology derived from the earlier Orchard system while maintaining separate accounting for transactions and balances.
The Zcash Ironwood network upgrade followed the discovery of a vulnerability in Orchard that could have allowed counterfeit coins to circulate without detection.
Developers introduced safeguards restricting transfers from the older pool and created a replacement pool with updated cryptographic protections. The upgrade was designed to make Zcash’s circulating supply independently verifiable.
Ironwood was not introduced as an anti-money-laundering mechanism. Its main purpose was to address the Orchard security issue while retaining shielded transaction functionality.
The protocol’s privacy features remain available to legitimate users and can be used by malicious actors. The October 17 allegations concern suspected use of those features by attackers, not a new vulnerability in the Ironwood protocol.
Bitget confirms $387.5 million stolen in September breach
Bitget’s September 24 security incident involved unauthorized transfers from portions of its hot and warm wallet infrastructure.
The exchange initially estimated the affected assets at $351.6 million. Its September 25 security update raised the figure to approximately $387.5 million following additional blockchain tracing and transaction classification.
Bitget explained that the revised estimate incorporated affected assets on Zcash and TRON that were not included in the original calculation. The $35.9 million difference resulted from a more complete accounting of the incident, not another confirmed wave of theft.
The exchange identified affected assets across Ethereum-compatible networks, XRP Ledger, Zcash and TRON. Its list included XRP, ETH, USDT, ZEC, USDC, BNB, AVAX and several other tokens.
Independent investigations by SlowMist and Google-owned cybersecurity firm Mandiant subsequently examined the attack. Bitget reported that both investigations identified compromised third-party security products that allowed unauthorized access to the exchange’s wallet environment.
As crypto.news previously reported, Bitget resumed Bitcoin withdrawals on September 28 after temporarily suspending withdrawal services while investigating the breach.
The exchange stated that attackers had not compromised its cold wallets or obtained private keys. It maintained that customer account balances remained unaffected and committed its User Protection Fund to covering the financial loss.
In a September 30 announcement, Bitget reported replenishing the protection fund to more than $300 million. Its September proof-of-reserves update separately showed a combined reserve ratio of 131% across 19 covered assets.
Investigators identify earlier attempts to conceal stolen funds
The reported Zcash transfers are not the first attempts by attackers linked to the Bitget breach to move assets through services designed to complicate transaction tracing.
Following the September attack, blockchain analytics firm AMLBot tracked approximately four BTC linked to the incident entering a Wasabi CoinJoin transaction.
The Bitget hacker’s CoinJoin transfers reportedly followed a route involving TRON, USDT0, Ethereum, THORChain and Bitcoin.
CoinJoin combines transaction inputs and outputs from several participants, making it harder to determine which output belongs to an individual sender.
Separate blockchain tracking identified approximately 2,390 ETH converted into 75.2 BTC through 27 transactions on THORChain, worth around $6.3 million at the time.
Bitget had requested that THORChain restrict addresses linked to the theft. The network’s operators maintained that their emergency controls could suspend network activity but could not selectively block an individual user’s swap.
In the days after the breach, Bitget introduced a recovery bounty program offering rewards for eligible assistance in freezing and recovering stolen assets.
The program provides 5% of successfully frozen funds to qualifying contributors and a separate 5% for funds successfully recovered through eligible voluntary actions.
Bitget excluded actions carried out under court orders or law-enforcement instructions from bounty eligibility. It retained final responsibility for determining qualifying contributions and calculating payments.
Bitget recovery investigation remains active
As investigators continue following the stolen assets, the exchange has made identified attacker addresses available to security firms, blockchain projects and other organizations involved in tracing.
Its September 25 announcement included addresses on Ethereum-compatible networks, XRP Ledger, Zcash and TRON, alongside a public recovery reporting system.
Bitget said the tracing dashboard would be updated as investigators identified additional wallets or movements associated with the incident. The exchange encouraged custodians, stablecoin issuers and trading platforms to report relevant discoveries.
The September breach accounted for the largest single incident in crypto’s $768 million hack month, according to October 1 findings from blockchain security firms PeckShield and CertiK.
PeckShield recorded $766.5 million across 55 major September incidents, while CertiK estimated $768.4 million across 97 incidents. Their totals used different reporting methods and counted gross affected amounts, including assets subsequently recovered.
For the newly reported Zcash transfers, Specter has not disclosed a complete accounting of the funds associated with Cryptobills Ledger or Triple-A. No confirmed recovery amount or final destination has been established for those specific transfers.