Onchain data shows hackers moving stolen funds to Zcash

On-chain investigators have identified additional suspected stolen cryptocurrency moving into Zcash (ZEC), with funds reportedly linked to three separate security incidents involving Bitget, Cryptobills Ledger and Triple-A. Summary On-chain investigator Specter linked alleged stolen funds from three security incidents to Zcash transactions recently. ZachXBT traced approximately 2,700 ZEC into Zcash’s Ironwood shielded pool following the September Bitget breach. Bitget confirmed approximately $387.5 million reached attacker-controlled addresses during its September 24 security incident investigation. Specter identified Cryptobills Ledger and Triple-A funds entering Zcash without publishing complete transaction-level evidence publicly. Zcash activated Ironwood in July 2026, creating a new shielded pool after an Orchard vulnerability. In an October 17 post on X, blockchain analyst Specter reported that funds associated with the Cryptobills Ledger incident and the $12 million Triple-A exploit had entered Zcash, following earlier findings by investigator ZachXBT concerning assets stolen from Bitget. The latest allegations concern the movement of stolen cryptocurrency into a privacy-focu...