Stolen Crypto Routed Into Zcash Shielded Pools, Raising Traceability Concerns

Overview

• Bitget confirmed that a September 24 security breach let attackers take about $387.5 million and investigators have been tracing those proceeds across multiple blockchains.
• On September 30 investigator ZachXBT traced roughly 2,700–2,746 ZEC from wallets linked to the Bitget attacker into Zcash’s Ironwood shielded pool, where details are obscured after deposit.
• On October 17 on-chain researcher Specter publicly alleged additional transfers tied to the Ledger/Cryptobills supply‑chain incident and a $12 million Triple‑A exploit moved into Zcash, but he has not published full transaction trails or exact amounts for those cases.
• Ironwood was activated in a July 28, 2026 upgrade to replace Orchard and preserve optional shielded transactions, which hide sender, recipient and amount and so sharply reduce downstream tracing and recovery options.
• Exchanges and forensic teams have engaged outside firms, used protection funds and launched bounties to try to freeze or recover assets, and the reports have driven a roughly 16% rise in ZEC shielding plus near‑term negative market sentiment and renewed regulatory scrutiny.