Hackers behind one of 2026’s largest crypto exchange breaches have started funneling stolen funds into Zcash’s shielded pool, a privacy feature that blocks outside observers from seeing who sent what to whom. On-chain investigator ZachXBT flagged the movement on September 30, 2026, tracing roughly 2,746 ZEC, worth about $3.9 million, into Zcash’s Ironwood shielded pool in three separate transfers. The deposits mark one of the clearest documented cases yet of attackers turning to a privacy coin specifically to break the forensic trail that blockchain analytics firms rely on to track stolen crypto.
The transfers trace back to the breach of Bitget, a major cryptocurrency exchange, on September 24, 2026. Bitget’s hack resulted in losses of approximately $387.5 million once it identified additional Zcash and TRON-related transactions tied to the same intrusion. The Zcash deposits represent about 15% of the roughly 18,900 ZEC that investigators attributed to the attacker’s wallet cluster, according to CoinDesk’s review of the transaction records.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What happened on September 30
According to on-chain data reviewed by multiple outlets, the Bitget-linked wallets moved their ZEC into Zcash’s Ironwood shielded pool through three transactions. Ironwood is the mechanism inside the Zcash protocol that conceals the sender, the recipient, and the transfer amount for any transaction routed through it. Investigators and exchanges can still see funds entering or leaving the pool, but the protocol does not expose a direct line connecting a deposit to a later withdrawal, which is precisely why the technique appeals to anyone trying to break a forensic trail.
That distinction matters for anyone trying to understand why this case is getting attention beyond the crypto press. Most stolen-fund tracing depends on following a public, transparent ledger from the point of theft to an exchange, a mixer, or a cash-out point. Bitcoin, Ethereum, and most other major chains broadcast transaction details, including amounts and wallet addresses, to anyone running a node. Zcash’s shielded pool breaks that chain of visibility at the exact moment funds enter it, which is why security researchers describe privacy coins as a structural challenge rather than just another obstacle.
ZachXBT, the pseudonymous blockchain investigator who has built a reputation tracking North Korea-linked hacking groups and exchange breaches, was the first to publicly flag the Ironwood deposits. His analysis connected the shielded transfers to intermediary wallets that had been funded from an address Bitget had already identified as belonging to the attacker, giving outside researchers a documented link between the breach and the laundering attempt even though the shielded transactions themselves remain opaque. Coverage aggregated across multiple outlets shows the transfers landed between 08:15 and 08:46 UTC on September 30.
The THORChain route: a second laundering channel
The Zcash shielding wasn’t the only technique investigators flagged in the Bitget case. Separately, researchers traced approximately $6.3 million in proceeds through Ether-to-Bitcoin swaps executed via THORChain, a decentralized cross-chain liquidity protocol that lets users swap assets across different blockchains without relying on a centralized exchange. That route works differently from Zcash shielding: instead of hiding transaction details within a single network, it changes the asset and the chain entirely, making the funds harder to link back to the original theft by the time they land on a new blockchain in a different form.
Together, the Zcash and THORChain moves illustrate a pattern that has become familiar to blockchain forensics teams: attackers rarely rely on a single laundering method. Rapid cross-chain conversion followed by movement into a privacy-enhancing system is now a recognizable playbook, one that combines the speed of decentralized swaps with the opacity of shielded pools to complicate any single tracing approach. Cryptopolitan’s reporting on the case notes that the $3.9 million shielded through Ironwood represents roughly 15% of the ZEC the attackers are believed to hold, with the remainder still sitting in transparent, traceable wallets for now.
Zcash’s privacy pool, explained
Zcash has offered optional privacy features since its 2016 launch, letting users choose between transparent addresses, which behave like Bitcoin’s public ledger, and shielded addresses, which use zero-knowledge proofs to hide transaction details while still letting the network verify that no coins are created or duplicated. Ironwood is the current generation of that shielded infrastructure. For most of Zcash’s history, shielded transactions made up a small minority of total activity, in part because the computational overhead made them slower and more expensive to generate.
That has changed. Zcash’s price and shielded-pool activity have both climbed sharply through 2026, and the currency has drawn attention as a go-to tool for anyone trying to move funds without leaving a visible trail. The irony for Zcash as a project is that its privacy technology, built and marketed for legitimate reasons such as protecting commercial transaction data and individual financial privacy, is the same feature now drawing scrutiny because it is attractive to hackers moving stolen funds.
A separate, larger laundering trail: $103.4 million across seven chains
The Bitget case isn’t an isolated data point. A separate investigation, reported by TokenPost, attributed approximately $103.4 million in stolen cryptocurrency to activity spread across 530 addresses and seven different blockchains. That investigation reportedly relied in part on fee-payment patterns, a forensic technique that looks at how attackers paid network fees across transactions, to connect wallets that would otherwise appear unrelated. The scale of that figure, more than a quarter of what Bitget itself lost, underscores that cross-chain laundering using a combination of privacy tools and decentralized swap protocols has become a standard part of the post-breach playbook rather than a one-off technique tied to a single incident.
That $103.4 million figure is notable because it did not rely on a single chain or a single laundering method. Instead, it points to attackers deliberately fragmenting stolen funds across many smaller wallets and multiple blockchains, a strategy designed to make any single trace dead-end quickly even without the added layer of a shielded pool.
By the numbers: the Bitget breach and its laundering trail
| Metric | Figure | Source detail |
|---|---|---|
| Bitget breach date | September 24, 2026 | Hot wallet compromise |
| Initial loss estimate | ~$387.5 million | Revised upward after further analysis |
| Revised total loss | ~$387.5 million | Includes additional ZEC and TRON transfers |
| ZEC moved to Ironwood pool | 2,746 ZEC (~$3.9 million) | Three transactions, September 30 |
| Share of stolen ZEC shielded | ~15% | Of the attacker’s ZEC holdings |
| Funds routed via THORChain | ~$6.3 million | Ether-to-Bitcoin swaps |
| Separate multi-chain theft trail | ~$103.4 million | Across 530 addresses, seven blockchains |
Why hackers are turning to privacy coins now
Crypto laundering has historically relied on mixers, chain-hopping, and over-the-counter brokers willing to convert stolen funds into cash with minimal questions asked. Each of those methods has grown riskier over the past few years as exchanges tightened compliance screening and as blockchain analytics firms improved their ability to flag tainted funds the moment they touch a regulated platform. Shielded pools offer something those older methods cannot: a point in the transaction history where the trail simply stops being visible to anyone outside the transaction itself, rather than merely becoming harder to follow.
That structural difference explains why security researchers increasingly flag privacy-coin shielding as a distinct and growing category of concern, separate from the chain-hopping and mixer use that has dominated laundering headlines for years. A mixer pools funds from many users and relies on volume and timing to obscure a given transaction; a well-resourced investigator can sometimes still narrow down probabilities. A shielded pool built on zero-knowledge proofs is designed from the protocol level up to make that kind of probabilistic unmasking mathematically infeasible for transactions routed entirely within it.
This dynamic puts exchanges and blockchain forensics firms in an uncomfortable position. They can watch funds enter and leave a shielded pool, which gives them a timestamp and an amount at the boundary, but they lose the ability to definitively link a specific deposit to a specific withdrawal once funds have moved through Ironwood. That gap is exactly what attackers are counting on when they choose this route over a straightforward exchange cash-out.
Competitive landscape: how privacy tools compare for laundering resistance to tracing
Not every privacy or mixing tool offers attackers the same level of protection, and the differences matter for understanding why Zcash specifically has drawn attention in this case.
| Method | How it obscures funds | Known limitation for launderers |
|---|---|---|
| Zcash shielded pool (Ironwood) | Zero-knowledge proofs hide sender, recipient, and amount within the pool | Entry and exit points into the pool remain visible |
| THORChain cross-chain swaps | Converts assets across blockchains without a centralized intermediary | Swap amounts and timing are still publicly visible on both chains |
| Centralized mixers | Pools funds from many users to obscure individual transactions | Often subject to compliance monitoring and law enforcement seizure |
| Chain-hopping across many wallets | Fragments funds across hundreds of addresses and blockchains | Fee-payment patterns can still link related wallets, as seen in the $103.4 million case |
The comparison highlights why the Bitget attackers reportedly used more than one method rather than relying solely on Zcash. Each technique closes off a different type of forensic analysis, and combining them, as seen with the parallel use of Ironwood and THORChain, forces investigators to chase multiple disconnected threads instead of one continuous trail.
Historical context: privacy coins have been a laundering concern for years
Concerns about Zcash and similar privacy-focused cryptocurrencies being used for illicit purposes are not new. Monero and Zcash have both faced periodic exchange delistings in jurisdictions with stricter anti-money-laundering rules, and regulators in several countries have previously flagged privacy coins as higher-risk assets specifically because standard blockchain monitoring tools cannot fully trace shielded transactions. What makes the Bitget case notable within that longer history is the scale and the directness of the link: a large, well-documented exchange breach with a traceable attacker wallet cluster that moved a meaningful share of its stolen funds into a shielded pool within days of the theft, rather than the more ambiguous, harder-to-prove patterns that have characterized earlier privacy-coin laundering concerns.
Large exchange breaches themselves have become a recurring feature of the crypto industry’s history, from early incidents involving now-defunct platforms through more recent breaches at major exchanges. What has shifted over that period is less the frequency of breaches and more the sophistication of the laundering methods that follow them, moving from simple cash-outs through compromised accounts toward multi-step chains involving cross-chain swaps and privacy pools designed specifically to defeat the forensic tools that have improved alongside them.
Market impact: what this means for Zcash and exchange security
Zcash’s token has seen a dramatic price run over the past year, and the currency’s association with high-profile laundering activity creates a tension that the project will likely have to navigate going forward. Attention from a major breach can function as a double-edged sword for a privacy coin: it demonstrates the protocol delivers on its core promise of confidentiality, which sustains demand from legitimate users who want financial privacy, but it also invites increased regulatory scrutiny and the kind of exchange delisting pressure that has hit privacy coins before.
For exchanges like Bitget, the breach reinforces an uncomfortable reality: even after a theft is detected and attacker wallets are identified, there is often little an exchange can do once funds reach a shielded pool beyond publicizing the wallet addresses and asking the broader crypto community, including other exchanges, to flag and freeze any funds that later surface from known attacker-linked addresses. That reactive posture, rather than a technical fix, remains the primary defense against this laundering method today.
The incident also adds pressure on compliance teams at exchanges that list Zcash and similar privacy assets. Expect renewed internal debate at trading platforms over whether enhanced monitoring requirements, additional verification steps for large ZEC withdrawals, or outright delisting discussions become more common in the months following this case, particularly if additional breaches show a similar pattern of funds flowing into shielded pools shortly after a theft.
What investigators can still do
Despite the opacity Ironwood provides within the pool itself, investigators are not entirely blind. The boundary transactions, the moment ZEC enters or leaves the shielded pool, remain visible on-chain, which is exactly how ZachXBT was able to flag the September 30 transfers in the first place. That visibility at the edges gives analysts a few angles of attack: timing correlation between deposits and later withdrawals, amount matching when withdrawal sizes are distinctive enough to stand out, and tracking any funds that eventually surface on a centralized exchange that enforces know-your-customer identity checks.
The $103.4 million case traced across 530 addresses and seven blockchains shows that fee-payment analysis, essentially following the small, consistent patterns in how an attacker pays network transaction fees across many separate wallets, can link addresses together even without any single transaction revealing the full picture. These kinds of indirect forensic techniques are likely to become more important as more sophisticated laundering chains combine privacy pools with cross-chain swaps and wallet fragmentation.
Predictions: where this story goes next
- Expect more documented cases of stolen funds moving into Zcash’s Ironwood pool following other exchange breaches, as attackers who see this method succeed are likely to replicate it rather than abandon a technique that has worked.
- Exchanges that list ZEC will likely face growing pressure to implement enhanced transaction monitoring specifically for large shielded-pool withdrawals, even though the technical limits of shielded transactions mean full visibility is unlikely to return.
- Regulatory bodies in jurisdictions with strict anti-money-laundering requirements may revisit delisting or enhanced-reporting discussions around privacy coins, echoing earlier debates over Monero and Zcash in prior years.
- Blockchain forensics firms will likely invest further in boundary analysis, the techniques used to correlate shielded-pool entry and exit points, since that remains the only point of leverage against fully shielded transactions.
- Attackers are likely to continue combining multiple laundering methods, such as pairing Zcash shielding with THORChain-style cross-chain swaps, rather than relying on any single technique, making future laundering trails harder to characterize with one label.
The bigger picture for crypto security
The Bitget case lands at a moment when the broader crypto industry is already grappling with the scale of funds moving through laundering channels. Earlier reporting attributed tens of billions of dollars in crypto laundering activity to a wide range of techniques tracked by blockchain analytics firms, and the addition of privacy-coin shielding as a documented, traceable component of a major breach’s aftermath adds a new wrinkle to that broader pattern. It is a reminder that the tools built to protect legitimate financial privacy and the tools exploited to hide stolen funds are, in cases like Zcash’s shielded pool, one and the same, which leaves little room for a purely technical fix that would stop one use case without affecting the other.
For now, the documented trail in the Bitget case stops at the edges of the Ironwood pool. What happens to that $3.9 million once it resurfaces, if it resurfaces on a traceable platform, will likely shape how exchanges, regulators, and the Zcash project itself respond to a laundering method that has moved from theoretical concern to demonstrated practice within a single high-profile breach.
Frequently Asked Questions
What is Zcash’s Ironwood shielded pool?
Ironwood is the current shielded transaction system within the Zcash protocol. It uses zero-knowledge proofs to hide the sender, recipient, and amount of any transaction routed through it, while still letting the network verify the transaction is valid.
How much money did the Bitget hackers move into Zcash?
Wallets linked to the Bitget breach moved approximately 2,746 ZEC, worth about $3.9 million, into Zcash’s Ironwood shielded pool through three transfers on September 30, 2026, according to on-chain analysis reviewed by multiple outlets.
How much was stolen in the Bitget hack overall?
Bitget’s hack resulted in losses of approximately $387.5 million after identifying additional Zcash and TRON-related transfers tied to the same breach.
Who discovered the Zcash transfers?
On-chain investigator ZachXBT first flagged the three transfers into the Ironwood shielded pool, linking them to intermediary wallets funded from an address Bitget had already identified as belonging to the attacker.
Can investigators trace funds once they enter a Zcash shielded pool?
Investigators can see funds entering or leaving the shielded pool, including amounts and timing at those boundary points, but the protocol does not expose a direct transaction trail linking a specific deposit to a specific withdrawal within the pool itself.
What is THORChain’s role in this laundering case?
Separately from the Zcash transfers, investigators traced approximately $6.3 million in proceeds through Ether-to-Bitcoin swaps executed via THORChain, a decentralized cross-chain swap protocol that converts assets across different blockchains without a centralized intermediary.
Is this the only major crypto laundering case involving multiple blockchains in 2026?
No. A separate investigation attributed approximately $103.4 million in stolen cryptocurrency to activity spread across 530 addresses and seven different blockchains, showing that multi-chain fragmentation is a broader pattern beyond the Bitget case alone.
Will exchanges delist Zcash because of this?
No delisting has been reported in connection with this specific case. Privacy coins including Zcash have faced delisting pressure in some jurisdictions before, driven by anti-money-laundering compliance requirements, and renewed scrutiny following high-profile laundering cases could reignite those discussions at individual exchanges.
