On-chain investigators say suspected stolen funds from three security incidents, involving Bitget, Cryptobills Ledger and Triple-A, have moved into Zcash. Specter did not publish a full transaction trail, so the amounts tied to the two newer cases remain unknown.
Blockchain analyst Specter reported on October 17 that funds from the Cryptobills Ledger incident and the $12 million Triple-A exploit had entered Zcash. The post followed earlier findings by investigator ZachXBT on assets stolen from Bitget.
However, Specter did not publicly provide a complete transaction trail or establish how much money from the two additional incidents had entered ZEC. The analyst also did not claim that one attacker was responsible for all three incidents.
ZachXBT traces Bitget proceeds into Ironwood
ZachXBT said on September 30 that wallets allegedly tied to the attackers transferred approximately 2,700 ZEC into Zcash's Ironwood shielded pool, which he valued at roughly $3.8 million at the time. Those transaction references support tracing only up to the deposits, and they do not show where the funds went after shielding.
Ironwood is a newer shielded pool that arrived with Zcash's July 28, 2026, upgrade, which followed the discovery of a vulnerability in Orchard. Its main purpose was to fix that issue, not to act as an anti-money-laundering mechanism.
Bitget puts the September loss at $387.5 million
The September 24 incident involved unauthorized transfers from portions of Bitget's hot and warm wallet infrastructure. The exchange first estimated the affected assets at $351.6 million, then raised the figure to approximately $387.5 million in its September 25 update after adding affected assets on Zcash and TRON.
Bitget said the attackers had not compromised its cold wallets or obtained private keys. It also committed its User Protection Fund to covering the loss.
Earlier attempts to hide the funds
Zcash is not the first route. Blockchain analytics firm AMLBot tracked approximately four BTC linked to the breach into a Wasabi CoinJoin transaction. Separate tracking identified approximately 2,390 ETH converted into 75.2 BTC through 27 transactions on THORChain.
Bitget's recovery bounty program offers 5% of successfully frozen funds to qualifying contributors. For the new Zcash transfers, no confirmed recovery amount or final destination has been established.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
