On-chain analyst Specter reported that stolen funds linked to several crypto incidents are moving into Zcash, extending activity beyond the September Bitget attack. The reports describe transfers by multiple threat actors and cite investigator ZachXBT’s account of funds being shielded through Zcash.
The transfers include funds associated with the Cryptobills Ledger incident and proceeds from the $12 million Triple-A exploit, Specter said. His findings followed ZachXBT’s disclosure about the Bitget exploiter moving assets. The reports do not identify the people behind the additional transfers.
Stolen Funds Moving Across Several Incidents
ZachXBT reported that attackers stole approximately 18,900 ZEC from a hot wallet on September 24, 2026. He valued those tokens at approximately $28.3 million in a Telegram update included with Specter’s post. The report said the alleged attackers then began shielding approximately 2,700 ZEC through Zcash’s Ironwood pool, worth about $3.8 million.
Those figures cover the ZEC holdings in the investigator’s account. They are distinct from Bitget’s broader losses across multiple networks. The distinction matters because the Zcash transfers describe one part of the reported activity, while the exchange’s estimate covers assets on 11 blockchains.
The account of funds entering Zcash also reaches beyond the Bitget exploiter. Specter identified transfers connected to Cryptobills Ledger and the Triple-A exploit, and attributed the movements to multiple threat actors. The supplied reports do not provide a complete transaction-by-transaction breakdown for those incidents.
Bitget Loss Estimate Rose After Investigations
Security firms SlowMist and Mandiant confirmed estimated losses totaling $387.5 million across 11 blockchains, according to the report. Bitget’s initial estimate after the attack was $351.6 million. The later assessment raised the reported total by $35.9 million.
The Bitget incident involved assets beyond ZEC, according to the reporting. The exchange’s reported losses therefore should not be read as a Zcash-only figure. A separate report on a Bitget crypto theft also describes the exchange incident.
Crypto investigations can involve different allegations, victims and amounts. In a separate case, prosecutors alleged a $328 million scheme involving Goliath Ventures, as detailed in coverage of a crypto Ponzi case. Another report described investors who lost money in the Key Coin Assets scheme. Those cases are not identified as connected to the Zcash transfers.
Bitget Announced One-Time Account Closures
Bitget announced on October 17 that it would discontinue services for certain customers. The exchange described the move as a one-time account closure exercise affecting a subset of users. The report did not state how many accounts would close or connect the closures to particular Zcash transfers.
The article also reported an estimated $90 million in cryptocurrency stolen after spyware was implanted in some Ledger wallets. Reports said Ledger had received warnings about wallet tampering months before the losses came to light. The source does not establish that those wallet incidents were part of the Bitget exploit.
Market figures in the report placed ZEC at $1,142.98, down 3.7% over 24 hours. CoinGecko’s displayed range was $1,132.57 to $1,190.18. The same data listed a $19.425 billion market capitalization and $664.152 million in daily trading volume. The price snapshot gives market context, but does not establish that the reported transfers caused the decline.
For now, the account identifies transfers and reported losses, but leaves the additional actors unnamed. The source provides no further transaction details or investigative outcome for the Cryptobills Ledger and Triple-A movements.
