In this article4 sections
Stolen crypto tied to three separate security incidents has been routed into Zcash shielded pools, according to Ambcrypto. The outlet cited Web3 security researcher Specter, who reported that funds from the recent Ledger supply chain attack and $12 million from payment firm Triple-A had entered a shielded pool.
Ambcrypto linked the latest activity to earlier tracing by investigator Zachary Wolk, known as ZachXBT, who tied roughly $4 million of ZEC from the Bitget exploit to Ironwood’s shielded pool. Crypto.news, citing ZachXBT’s September 30 findings, put the Bitget-linked inflow at about 2,700 ZEC worth roughly $3.8 million, while Bitcoinist reported approximately 2,746 ZEC valued at about $3.9 million, the three outlets giving slightly different figures for the same traced transfers.
Also read: Bitget Hack: $157M in Stolen XRP Cannot Be Frozen
Key facts
- Specter’s October 17 post named the Cryptobills Ledger incident and the $12 million Triple-A exploit as sources of funds entering Zcash, per Crypto.news.
- Bitget confirmed approximately $387.5 million was stolen in its September 24 breach, up from an initial estimate of $351.6 million, Crypto.news reported.
- Zcash activated the Ironwood shielded pool through a network upgrade on July 28, 2026, following an Orchard vulnerability, according to Crypto.news.
- ZEC shielded supply rose 16% from 4.3 million to 4.96 million ZEC since July, Ambcrypto reported.
- Blockchain analytics firm AMLBot tracked roughly four BTC linked to the Bitget incident entering a Wasabi CoinJoin transaction, per Crypto.news.
What investigators said
Specter did not publicly publish a complete transaction-level trail, and Crypto.news noted the researcher did not establish how much from the Ledger and Triple-A incidents reached ZEC. Specter described several threat actors rather than attributing all three incidents to one group. ZachXBT separately identified about 18,900 ZEC, worth $28.3 million, among assets tied to the Bitget case.
Bitcoinist stressed that shielded transfers do not reveal the same information about sender, recipient and amount once funds enter the pool, but that this does not mean the network’s cryptography failed. Crypto.news made the same point, noting Ironwood was built to address the Orchard security issue and was not designed as an anti-money-laundering mechanism.
Also read: Zcash Whale Doubles ZEC Holdings to $66.75M Amid 34% Drop
Why it matters
The flows highlight a gap in tracing: centralized exchanges and stablecoin issuers can freeze assets under AML rules, leaving privacy tools and mixers as routes that evade seizure. Monero, which is private by default, was delisted from Binance and banned in the EU after similar concerns. Zcash keeps privacy optional, which means regulators may scrutinize it if it becomes a major destination for stolen funds. Ambcrypto reported ZEC’s market sentiment fell to a fear level of 28, and asked whether the asset could slip below $1,000 under deeper regulatory and market pressure. That is a speculative scenario, not a forecast: this is not financial advice, and crypto markets are volatile and uncertain.
What to watch
Bitget’s recovery effort is still active, with attacker addresses shared with security firms and blockchain projects, and Crypto.news reported no confirmed recovery or final destination for the Ledger or Triple-A transfers. Any further tracing, or regulatory response to the shielded-pool use, will shape the next stage of the story.
Reported by ambcrypto.com.
Sources: AMBCrypto, Crypto.news, Bitcoinist