KEY INSIGHTS
- Stolen cryptocurrency was washed with Zcash shielded wallets by hackers in order to avoid being caught during trace analysis.
- Researchers were able to trace stolen cryptocurrency through wallet connections and similar transactions without decryption of Zcash.
- Tether has frozen $10 million in USDT linked to the hack as tracing of the funds continues across different blockchains.
The hackers involved in massive cryptocurrency thefts have begun moving funds stolen in such attacks into Zcash’s shielded pool to obscure their transaction history, according to blockchain experts. It is thought that the transfers may include funds stolen in the Bitget hack of September 2026, in the Ledger hardware wallet theft involving CryptoBilis, and the Triple-A $12 million hack.
Zcash Privacy Features Complicate Stolen-Fund Investigations
The on-chain analyst ZachXBT pointed out on September 30, 2026, that the wallets involved in the Bitget hack transferred around 2,746 ZEC worth about $3.9 million into the Ironwood privacy pool of Zcash.
The Bitget breach, which occurred on September 24, resulted in approximately $387.5 million in losses after additional transactions involving Zcash and TRON were linked to the incident. Investigators attributed roughly 18,900 ZEC to the attacker’s wallet cluster, placing the reported shielded transfers at approximately 15% of that amount.
Zcash supports transparent transactions and shielded transactions. In transparent transactions, all transaction information is exposed on the blockchain for everyone to see. In shielded transactions, however, the sender, receiver, and sum of funds that have been transferred remain anonymous to the third parties.
Ironwood is the name of the technology used to conduct the shielded transactions. It is not difficult to trace any funds deposited or withdrawn from the pool. What cannot be traced, however, is the connection between the two transactions.
The Bitget-related transactions highlight the additional difficulties investigators will experience once the stolen crypto is moved into the privacy wallet. At that point, any information about the transaction will be hidden, meaning there will be less information to trace from one point to the other.
Investigators Trace Cryptocurrency Without Decrypting Zcash
The case involving Ledger and CryptoBilis is yet another example of how investigators can follow the trail of stolen cryptocurrencies. The researcher Tayvano managed to follow $103.4 million worth of stolen cryptocurrencies over around 530 wallets on seven blockchain networks, per the provided research data.
The study discovered that the means by which the attacker paid for transaction fees was an essential connection between the wallets. The researchers made connections between wallets by analyzing the gas costs from an affiliate wallet.
The reported distribution included about three-quarters of the value in USDT on the TRON platform. Investigators also identified wallets holding approximately $38.6 million in ETH and $16.9 million in BTC. Tether froze $10 million in USDT linked to the theft.
Researchers also traced the Zcash-related portion of the investigation by matching 108 exact-value exits with incoming batches. The matching amounts provided a pattern for connecting fund movements without exposing or defeating the cryptographic protections governing shielded transactions.
Tayvano emphasized that the tracing did not mean Zcash’s privacy protections had been broken. Instead, the findings pointed to transaction behavior that investigators could analyze. The distinction separates a weakness in an individual operator’s handling of funds from a compromise of the privacy protocol itself.
Multiple Laundering Routes Appear Across Crypto Hacks
Wu Blockchain reported on October 17, citing on-chain analyst Specter, that hackers were increasingly using Zcash to conceal the movement of stolen cryptocurrency. Specter said the trend had spread after ZachXBT disclosed that the Bitget attacker was using the privacy coin to hide stolen funds.
Source: Wu Blockchain
Specter also identified movements into Zcash involving funds stolen in the CryptoBilis-linked Ledger security breach and the $12 million Triple-A hack. The analyst said attackers appeared to be using the coin’s privacy features to launder assets and evade transaction tracing.
Zcash was not the only route identified in the Bitget investigation. Researchers separately traced approximately $6.3 million in proceeds through swaps from Ether to Bitcoin using THORChain, a decentralized cross-chain liquidity protocol.
The two methods obscure fund movements in different ways. THORChain enables asset exchanges across blockchains, while Zcash’s shielded pool conceals transaction details within its privacy system. Using both routes can complicate efforts to follow stolen assets through a single chain or tracing method.
The reported cases show how investigators are combining wallet relationships, fee-funding records and transaction-value patterns to track funds across different networks. At the same time, Tether’s freeze demonstrates that some stolen assets held in centrally issued stablecoins can be subject to issuer intervention.
