Zcash Ironwood Linked to Stolen Crypto from Major Hacks

stolen funds traced into Zcash shielded pool

On-chain investigators have reported fresh evidence that cryptocurrency proceeds from several high-profile breaches were routed into Zcash's shielded pools, specifically Ironwood. Analysts Specter and ZachXBT tied transfers to three separate incidents — the September Bitget breach, the Cryptobills Ledger attack and the Triple-A exploit — raising renewed focus on how privacy-focused networks can be used to obscure stolen assets. While tracing has identified deposits into Zcash, investigators stress that shielding limits visibility and final destinations remain unclear.

What investigators found

Specter and ZachXBT’s timelines

Blockchain researcher Specter posted on X on October 17 that funds believed to be linked to Cryptobills Ledger and the $12 million Triple-A exploit entered Zcash after initial tracing tied Bitget theft proceeds to the network. Earlier, on September 30, investigator ZachXBT traced roughly 2,700 ZEC — valued at about $3.8 million at the time — into Zcash’s Ironwood shielded pool, linking those deposits to wallets associated with the Bitget compromise.

Specter’s update did not publish a full transaction-level trail for the Cryptobills Ledger and Triple-A-linked transfers, and the analyst did not disclose the total sums moved from those incidents into ZEC. The report did, however, mark additional suspected use of privacy features by threat actors seeking to obscure funds across multiple blockchains.

Confirmed figures tied to Bitget

Bitget has acknowledged that its September 24 security incident resulted in approximately $387.5 million in affected assets after cross-chain tracing and analysis. That figure represents the exchange’s total assessed loss across a range of blockchains and token types, not the precise amount channeled into Zcash. Independent investigators identified about 18,900 ZEC among the compromised assets, of which 2,700 ZEC were specifically traced into Ironwood shielded transactions.

How Zcash shielding works and why investigators care

Shielded pools and privacy technology

Zcash supports both transparent and shielded transactions. Shielded pools use advanced zero-knowledge cryptography to hide sender, recipient and amount details when assets move into those pools. Ironwood, introduced in the July 28, 2026 network upgrade, is Zcash’s newer shielded pool created to address a prior vulnerability in the Orchard protocol. Ironwood keeps separate accounting and uses updated cryptographic primitives to prevent some forms of manipulation that were possible under Orchard.

From a forensic standpoint, deposits into shielded pools are identifiable as inflows but tracing where those funds go after shielding is far more difficult. Investigators can often connect transparent-chain activity up to the point of entry into a shielded pool, but once assets are concealed, external observers typically cannot see recipient addresses or subsequent transfers without cooperation from insiders or a breakthrough in cryptanalysis.

Ironwood was a security upgrade, not a laundering tool

Zcash developers implemented Ironwood primarily to remediate a vulnerability discovered in Orchard that could have allowed counterfeit coins to be created without detection. Ironwood was designed to make the circulating supply verifiable while preserving shielded transaction capability. The existence of a shielded pool is not inherently an AML (anti-money-laundering) feature or flaw; legitimate users rely on privacy-preserving transfers for safety and confidentiality, but malicious actors can leverage the same cryptography to try to hide illicit proceeds.

Other obfuscation methods observed in the Bitget case

CoinJoin, cross-chain swaps and THORChain routing

Zcash reports are not the only examples of attackers using privacy services or mixing techniques. After the Bitget breach, AMLBot traced roughly four BTC from the incident into a Wasabi CoinJoin transaction. CoinJoin services combine inputs and outputs from multiple users to make on-chain ownership mapping more complex.

Additional tracing identified about 2,390 ETH converted into 75.2 BTC through 27 THORChain transactions, valued at roughly $6.3 million at the time of conversion. The suspected flow included multiple token hops across TRON, USDT, Ethereum, THORChain and Bitcoin, demonstrating how attackers use interoperability and cross-chain liquidity to complicate forensic analysis.

Why exchanges and cross-chain protocols matter

Cross-chain bridges, decentralized exchanges and swapping protocols can unintentionally serve as laundering corridors when compromised wallets interact with multiple layers of infrastructure. In this case, Bitget asked THORChain to block addresses tied to the theft. THORChain’s operators noted that their emergency controls can suspend network activity but cannot selectively block a single user swap, underscoring limitations in policing purely decentralized environments.

Bitget’s response and recovery efforts

Investigations and user protections

After detecting unauthorized transfers, Bitget temporarily suspended withdrawals and commissioned independent security reviews. Firms including SlowMist and Mandiant (a Google-owned cybersecurity firm) examined the breach and reported that compromised third-party security products enabled unauthorized wallet access. Bitget maintained that cold wallets and private keys were not compromised and that customer account balances remained intact.

To address losses, Bitget committed its User Protection Fund and reported replenishing that fund to more than $300 million by September 30. The exchange also issued a proof-of-reserves update indicating a combined reserve ratio of 131% across 19 covered assets.

Recovery bounty and ongoing tracing

Bitget launched a recovery bounty program to incentivize third parties to help freeze and recover stolen assets. The program offers 5% of successfully frozen funds to qualifying contributors and an additional 5% for recovered funds obtained through eligible voluntary actions, excluding recoveries compelled by court orders or law enforcement. The exchange has published attacker addresses across multiple ledgers — Ethereum-compatible networks, XRP Ledger, Zcash and TRON — and maintains a public recovery reporting dashboard where custodians, stablecoin issuers and platforms can submit observations.

Limits of public tracing and unresolved questions

Visibility gaps after shielding

While analysts can often show links from stolen wallets to a shielded pool deposit, public evidence rarely provides a full account of transactions after funds are concealed. Specter’s October 17 post highlighted new suspected transfers into Zcash but did not include a complete transaction-level mapping for the Cryptobills Ledger or Triple-A-related movements. That lack of detailed public evidence means the total sums moved into ZEC, whether the funds were successfully anonymized, and their ultimate destinations remain uncertain.

Multiple actors, not a single operator

Available reporting suggests several threat actors were involved across the identified incidents. Specter did not assert that a single attacker orchestrated all three incidents; rather, the activity appears to have involved separate actors who used similar obfuscation strategies, including privacy coins, CoinJoin, and cross-chain swaps.

Implications for the crypto ecosystem

Privacy coins and regulatory attention

High-profile use of privacy-preserving protocols by attackers heightens scrutiny from regulators, exchanges and compliance teams. Privacy coins like Zcash provide legitimate privacy benefits, but when exploited by bad actors, they can trigger stricter exchange delistings, enhanced KYC/AML controls and cooperative enforcement actions. Policymakers and industry stakeholders will likely intensify dialogue on balancing privacy rights with the need to deter illicit finance.

Operational security for exchanges and custodians

The Bitget incident underscores the importance of rigorous third-party security assessments, multi-layer defenses for hot wallet infrastructure, and proactive monitoring across chains. Exchanges should maintain robust incident response plans, transparent communication with customers, and rapid coordination with blockchain analytics firms and law enforcement to track and, where feasible, freeze illicit flows.

Practical steps for investigators and market participants

For blockchain investigators

• Prioritize rapid collection of on-chain evidence up to the point of shielding. Deposits into shielded pools are a critical fork in the trail.
• Collaborate with cross-chain forensic vendors to map token swaps and bridge flows that precede shielding.
• Share non-sensitive indicators (wallet addresses, transaction hashes) with exchanges and custodians to enable suspensions and freeze attempts.

For exchanges and users

• Conduct regular audits of third-party security providers and adopt multi-sig or hardware-enforced controls for hot wallets.
• Maintain clear recovery and bounty programs to incentivize the crypto community to help trace and recover stolen assets.
• Educate users about privacy coins: they increase confidentiality but also complicate recovery when used illicitly.

Conclusion

On-chain research continues to connect portions of stolen cryptocurrency from major incidents to Zcash’s Ironwood shielded pool, reinforcing that privacy-preserving protocols are a common tool in the attacker toolkit. While deposits into shielded pools are observable events, the cryptographic protections that make privacy coins valuable for legitimate use also limit public forensic visibility after shielding. The evolving pattern of mixing, cross-chain swaps and shielded transfers highlights the need for coordinated tracing, stronger operational security across exchanges, and nuanced policy approaches that protect user privacy without enabling illicit finance.

As investigations into Bitget, Cryptobills Ledger and Triple-A progress, the crypto community should expect ongoing updates from forensic analysts, exchanges and enforcement agencies. For now, the central takeaway is clear: when assets enter privacy rails like Ironwood, tracing becomes harder, and preventing initial compromise through comprehensive security hygiene is the most reliable defense.