Key Takeaways
- • On-chain analyst Specter reported on October 17, 2026 that funds linked to the Cryptobills Ledger incident and the $12 million Triple-A exploit have entered Zcash (ZEC), though neither transfer amount was disclosed.
- • ZachXBT traced approximately 2,700 ZEC (about $3.8 million at the time) from wallets tied to the Bitget breach into Zcash's Ironwood shielded pool, per findings shared September 30.
- • Bitget's September 24 breach was revised to approximately $387.5 million across Ethereum-compatible networks, XRP Ledger, Zcash and TRON, though this figure covers the whole incident, not the amount moved into Zcash.
- • Ironwood, a shielded pool created in Zcash's July 28, 2026 upgrade to address an Orchard vulnerability, is not an anti-money-laundering mechanism, and the allegations concern misuse of existing privacy features rather than a protocol flaw.
- • Investigators can confirm deposits into shielded pools but cannot yet establish final destinations, and no confirmed recovery or complete accounting has been published for the Cryptobills Ledger or Triple-A transfers.
Summary
On-chain investigators have identified additional suspected stolen cryptocurrency moving into Zcash (ZEC), linked to three separate security incidents involving Bitget, Cryptobills Ledger and Triple-A. In an October 17 post on X, blockchain analyst Specter reported that funds associated with the Cryptobills Ledger incident and the $12 million Triple-A exploit had entered Zcash. Specter did not publish complete transaction-level evidence, did not quantify the amounts tied to the two additional incidents, and did not claim a single attacker was responsible for all three incidents.
The reported transfers build on earlier findings by investigator ZachXBT, who on September 30 traced approximately 2,700 ZEC, valued at roughly $3.8 million at the time, from wallets allegedly associated with the attackers into Zcash's Ironwood shielded pool. ZachXBT separately identified about 18,900 ZEC, worth $28.3 million at the reported valuation, among assets associated with the Bitget incident. The transaction references support tracing funds up to the identified shielded-pool deposits but do not reveal their destinations after shielding.
Bitget's September 24 security incident involved unauthorized transfers from portions of its hot and warm wallet infrastructure. The exchange initially estimated affected assets at $351.6 million, then raised the figure to approximately $387.5 million in its September 25 update after incorporating assets on Zcash and TRON. Bitget described the $35.9 million difference as a more complete accounting rather than a new wave of theft. The exchange said attackers did not compromise its cold wallets or obtain private keys, that customer balances were unaffected, and that its User Protection Fund would cover losses. SlowMist and Mandiant reportedly found that compromised third-party security products enabled unauthorized access to the wallet environment.
Ironwood was activated on July 28, 2026, as part of a Zcash network upgrade that followed the discovery of a vulnerability in the Orchard pool that could have allowed counterfeit coins to circulate undetected. Developers restricted transfers from the older pool and created a replacement pool with updated cryptographic protections. The upgrade was not designed as an anti-money-laundering measure. The October 17 allegations concern suspected use of Zcash's existing privacy features by attackers, not a new protocol vulnerability.
The Zcash transfers are not the first attempts to obscure proceeds from the Bitget breach. According to blockchain analytics firm AMLBot, about four BTC linked to the incident entered a Wasabi CoinJoin transaction, and separate tracking identified roughly 2,390 ETH converted into 75.2 BTC through 27 transactions on THORChain, worth about $6.3 million at the time. Bitget had asked THORChain to restrict linked addresses, but the network said its emergency controls could halt activity without selectively blocking individual swaps. Bitget has also launched a recovery bounty paying 5% of successfully frozen funds and a separate 5% of recovered funds, excluding actions taken under court orders or law-enforcement instructions. For the newly reported Zcash transfers, no confirmed recovery amount or final destination has been established.
The reported transfers build on earlier findings by investigator ZachXBT, who on September 30 traced approximately 2,700 ZEC, valued at roughly $3.8 million at the time, from wallets allegedly associated with the attackers into Zcash's Ironwood shielded pool. ZachXBT separately identified about 18,900 ZEC, worth $28.3 million at the reported valuation, among assets associated with the Bitget incident. The transaction references support tracing funds up to the identified shielded-pool deposits but do not reveal their destinations after shielding.
Bitget's September 24 security incident involved unauthorized transfers from portions of its hot and warm wallet infrastructure. The exchange initially estimated affected assets at $351.6 million, then raised the figure to approximately $387.5 million in its September 25 update after incorporating assets on Zcash and TRON. Bitget described the $35.9 million difference as a more complete accounting rather than a new wave of theft. The exchange said attackers did not compromise its cold wallets or obtain private keys, that customer balances were unaffected, and that its User Protection Fund would cover losses. SlowMist and Mandiant reportedly found that compromised third-party security products enabled unauthorized access to the wallet environment.
Ironwood was activated on July 28, 2026, as part of a Zcash network upgrade that followed the discovery of a vulnerability in the Orchard pool that could have allowed counterfeit coins to circulate undetected. Developers restricted transfers from the older pool and created a replacement pool with updated cryptographic protections. The upgrade was not designed as an anti-money-laundering measure. The October 17 allegations concern suspected use of Zcash's existing privacy features by attackers, not a new protocol vulnerability.
The Zcash transfers are not the first attempts to obscure proceeds from the Bitget breach. According to blockchain analytics firm AMLBot, about four BTC linked to the incident entered a Wasabi CoinJoin transaction, and separate tracking identified roughly 2,390 ETH converted into 75.2 BTC through 27 transactions on THORChain, worth about $6.3 million at the time. Bitget had asked THORChain to restrict linked addresses, but the network said its emergency controls could halt activity without selectively blocking individual swaps. Bitget has also launched a recovery bounty paying 5% of successfully frozen funds and a separate 5% of recovered funds, excluding actions taken under court orders or law-enforcement instructions. For the newly reported Zcash transfers, no confirmed recovery amount or final destination has been established.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.