ZachXBT Zcash Investigation: How Stolen Crypto Flows Into ZEC Shielded Pools
2026-10-26
The ZachXBT Zcash investigation shows exactly how stolen crypto flows into ZEC shielded pools after major exchange hacks. Following the $387.5 million Bitget breach on September 24, 2026, the on-chain sleuth traced thousands of ZEC into Zcash’s Ironwood shielded pool, where zero-knowledge proofs make further movement far harder to follow. Other attackers are already copying the same route.
Analysts now link at least three incidents to Zcash, and ZEC has slid while traders weigh the risk of exchange action. This report explains what was traced, how Zcash shielded pool hacks work, and what could happen next.
Key Takeaways
ZachXBT traced 2,746 ZEC, about $3.9 million, from the Bitget exploit into Zcash's Ironwood shielded pool, roughly 15% of the stolen ZEC.
Analysts say funds from the CryptoBilis Ledger incident and the $12 million Triple-A exploit also moved into ZEC, and the price fell about 10.8% in a week.
No exchange had delisted or frozen ZEC as of the latest reports, but compliance pressure on privacy coins is the main risk to watch.
Zcash Shielded Pools in Simple Terms
A Zcash shielded pool is a private section of the Zcash blockchain that uses zero-knowledge proofs to hide the sender, the recipient and the amount of a payment. Zcash also supports public addresses that work like Bitcoin's open ledger, so users can choose between the two.
Think of it as a sealed envelope inside a glass building. Everyone can see an envelope go in, but nobody can read what happens to it inside. That is why privacy fans value the tool and why investigators worry when stolen money uses it.
What Investigators Can Still See
The door is not fully closed. Deposits into a pool are visible, and withdrawals back to public addresses become visible again. Investigators can compare entry and exit points using timing and amounts, although Zcash itself does not link one to the other.
ZachXBT Zcash Investigation: What Was Traced
The Bitget breach on September 24 cost the exchange $387.5 million. About 18,917 ZEC, worth roughly $28.3 million at the time, was taken from its hot wallet. On September 30, ZachXBT flagged wallets linked to the attacker sending ZEC into Ironwood, Zcash's newest shielded pool.
He said the funds passed through two intermediary addresses funded by a wallet Bitget identified as the attacker's. ZachXBT has described the incident as a North Korean (DPRK) operation, but that link is his allegation and has not been confirmed by Bitget.
The Numbers at a Glance
Why the Hackers Turned to Zcash
Other escape routes were closing. NEAR Intents said its screening system blocked more than $50 million in swap requests tied to the attackers, with about $503,000 frozen and roughly $166,000 slipping through. THORChain declined a request to block the hacker, and about $6.3 million in ether was swapped to bitcoin there.
More Hackers Follow Into ZEC
On October 17, on-chain analyst Specter said several attackers had followed the Bitget exploiter into Zcash. His list included the CryptoBilis Ledger incident, involving hardware wallets sold by a Southeast Asian reseller, and the Triple-A hack, a Singapore-based payments firm that lost about $12 million.
Specter said the CryptoBilis attacker had converted funds into ZEC across chains, and also deposited 2,990.3 ETH, about $7.5 million, into the Tornado Cash mixer on October 9 and 10. His warning was blunt: threat actors are actively using ZEC to move stolen funds.
What It Means for the ZEC Price
ZEC fell nearly 5% on October 17 and traded near $1,167, down roughly 10.8% on the week and more than 23% over 30 days. It closed at $1,126 that day, and its October 15 low was $1,072. Investigators have not tied the drop directly to hacker activity.
Leverage played a big part. A 10.7% drop on October 15 was linked to forced liquidations, which push prices down further. ZEC also swings harder than Bitcoin and Ethereum, helped by a 427.8% gain over the past year and thinner order books.
Stay informed on market shifts and manage your crypto with confidence. Register on Bitrue to explore trading tools and opportunities across supported assets.
Privacy Coin Exchange Delisting 2026: How Real Is the Risk?
Anti-money-laundering rules require exchanges to know where customer funds come from. Regulators see privacy coins as a compliance risk, and some platforms have delisted them before. Analysts argue a delisting is a bigger near-term threat to ZEC than hacker flows, since it would shrink the buyer base.
As of the latest reports, no exchange had restricted or removed ZEC because of the laundering stories. Zcash's NU7 upgrade, targeting a November 5 mainnet launch, speeds up blocks and retires the old Sprout pool, but it does not address where shielded coins came from.
The Counterargument
Not everyone sees privacy as the problem. At Token2049, Gemini co-founder Cameron Winklevoss said "know your customer is becoming kill your customer," arguing that identity data held by companies can be hacked. Balaji Srinivasan called Zcash "the currency of Western individuals."
Key Players in the Story
ZachXBT: Pseudonymous on-chain investigator who first flagged the Bitget funds entering Ironwood.
Specter: On-chain analyst who linked the CryptoBilis Ledger and Triple-A incidents to ZEC.
Bitget: The exchange hit by the $387.5 million breach, still working to recover assets.
Ironwood: Zcash's newest shielded pool, activated in a July 28, 2026 upgrade after a flaw was found in the older Orchard pool.
NEAR Intents and THORChain: Cross-chain swap services whose different responses shaped the laundering route.
Interpretation Cheat Sheet: Reading Shielded Pool Headlines
Deposit into a shielded pool: visible and trackable, but later movement inside is hidden.
Withdrawal to a public address: the best moment for investigators to trace funds again.
Small share shielded: about 15% here, so most stolen ZEC could still be watched.
Price drop on laundering news: may reflect leverage and sentiment as much as the hack itself.
Exchange notice: a delisting or deposit restriction would be a far stronger signal than any single report.
Summary
The investigation shows how tighter controls elsewhere push attackers toward privacy tools. Hackers shielded only a slice of the Bitget loot, but the pattern across three incidents is what regulators and exchanges will notice.
For ZEC, the key variable is not the hackers but the response. If exchanges stay quiet and the NU7 timeline holds, the market may treat the flows as noise. A single delisting could change that fast. This is not financial advice, so do your own research.
Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.
FAQ
How did hackers hide stolen funds in Zcash?
They sent ZEC into a shielded pool, where zero-knowledge proofs hide the sender, recipient and amount. In the Bitget case, 2,746 ZEC entered the Ironwood pool in three transfers.
What did ZachXBT find in the Zcash investigation?
He traced wallets linked to the Bitget attacker moving about $3.9 million in ZEC into Ironwood. He also alleged the attackers are linked to North Korea, which is unconfirmed.
Can stolen Zcash still be traced?
Partly. Deposits into the pool and later withdrawals to public addresses are visible, so investigators can compare timing and amounts. Transfers inside the pool are hidden.
Will exchanges delist ZEC in 2026?
No delisting had been reported as of the latest coverage. Privacy coins face ongoing compliance pressure, so the risk is real but unconfirmed.
Did the hacks cause the ZEC price drop?
Not directly, according to analysts. Forced liquidations, high volatility and bearish sentiment also played a role, though negative headlines can add pressure over time.
Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.
Disclaimer: The content of this article does not constitute financial or investment advice.
