TL;DR: Investigators have raised new concerns about stolen crypto flowing into Zcash, following earlier tracing of roughly 2,746 ZEC linked to the Bitget breach. Shielded transactions obscure details after entry, but do not prove that the underlying network has been compromised.
Privacy is a legitimate feature of cryptocurrency. It is also what makes Zcash a difficult destination for investigators trying to follow money stolen in a hack.
An October 17 warning from on-chain investigator Specter drew attention to reported flows tied to several crypto security incidents, including Bitget and other reported thefts. The warning follows a more detailed September 30 tracing of approximately 2,746 ZEC, then valued at about $3.9 million, entering Zcash’s Ironwood shielded pool from wallets linked by investigators to the Bitget attacker.
Before assets reach a shielded pool, analysts can sometimes identify funding wallets, transfers and swapping patterns on public chains. Once inside the pool, the usual visible trail becomes harder to follow because shielded transfers do not publicly reveal the same information about sender, recipient and amount.
That does not make Zcash’s cryptography broken. Nor does the appearance of suspect funds establish wrongdoing by every person who uses private transactions. It illustrates the longstanding tension between financial privacy and investigations into theft.
The precise combined total for flows from the newer incidents remains less firmly established than the earlier Bitget transactions. Estimates should not be lumped together without transaction-level verification, particularly when the same funds may move repeatedly through intermediaries.
What investigators are highlighting is a recurring tactic: thieves may leave clues before entering a privacy system, but tracing the subsequent path becomes substantially more difficult. For exchanges and forensic teams, the most useful intervention may happen before stolen assets disappear from public view.
