Hackers increasingly route stolen crypto through Zcash to obscure trails
Security & Exploits ·
On-chain tracking shows multiple threat actors shifting stolen funds into Zcash's shielded pool after the Bitget exploiter set the pattern.
An on-chain analyst identified as Specter has flagged a growing pattern of hackers converting stolen cryptocurrency into Zcash (ZEC) to take advantage of its privacy features, according to wublockchain.xyz. The trend follows a disclosure from investigator ZachXBT about the Bitget exploiter shielding stolen assets through ZEC, which appears to have prompted other attackers to adopt the same laundering method.
Funds tied to the Cryptobills Ledger security incident have reportedly been traced moving into Zcash, alongside proceeds from the Triple-A exploit, which totaled $12 million. The repetition of this tactic across separate incidents suggests attackers are deliberately choosing Zcash's shielded transactions as a layer to obfuscate the origin and destination of stolen assets, rather than relying solely on mixers or cross-chain bridges as in past laundering schemes.
The underlying mechanic centers on Zcash's optional shielded pool, which can hide transaction details including sender, receiver, and amount when funds are moved through it. For threat actors seeking to break the on-chain link between a hack and the eventual cash-out point, routing stolen tokens through ZEC before converting to other assets offers a way to complicate forensic tracing efforts that blockchain analysts and exchanges typically rely on.
The pattern has been corroborated by separate on-chain commentary noting the broader rise in Zcash's use for laundering stolen funds, with some observers also raising unverified speculation about the proximity of a Zcash-linked legal office to a government intelligence building, a detail that remains unconfirmed and tangential to the laundering activity itself. The original observation was also shared directly by the analyst tracking these flows on x.com.
What remains unclear is the total volume of stolen funds that have moved into Zcash across these incidents, whether exchanges or compliance tools can effectively flag ZEC-denominated deposits tied to known exploits, and whether additional threat actors beyond those linked to Bitget, Cryptobills Ledger, and Triple-A will adopt the same laundering route. Analysts are likely to continue monitoring shielded-pool inflows for signs of further stolen-fund consolidation.