On-chain analyst Specter has reported that stolen funds linked to several cryptocurrency incidents are being moved into Zcash, extending the activity beyond September's Bitget attack. The reports describe transfers carried out by multiple threat actors and cite investigator ZachXBT's account of funds being shielded through Zcash.

Specter said the transfers include funds connected to the Cryptobills Ledger incident and proceeds from the $12 million Triple-A exploit. His findings followed ZachXBT's disclosure that the Bitget exploiter had started moving assets. The reports do not identify the individuals behind the additional transfers.

Stolen Funds Span Several Incidents

ZachXBT reported that attackers stole approximately 18,900 ZEC from a hot wallet on September 24, 2026, valuing the tokens at roughly $28.3 million in a Telegram update included with Specter's post. According to the report, the alleged attackers then began shielding approximately 2,700 ZEC through Zcash's Ironwood pool, an amount worth about $3.8 million. Shielding, in this context, means moving assets into one of Zcash's privacy pools, where transaction details such as sender, recipient, and amount are not publicly displayed on-chain — a design that limits the public data available for tracing funds once they enter.

Those figures reflect only the ZEC holdings in the investigator's account and are separate from Bitget's broader losses across multiple networks. The distinction matters because the Zcash transfers represent one portion of the reported activity, while the exchange's estimate covers assets spread across 11 blockchains.

The flow of funds into Zcash also reaches beyond the Bitget exploiter. Specter identified transfers tied to the Cryptobills Ledger incident and the Triple-A exploit, attributing the movements to multiple threat actors. The reports do not include a complete transaction-by-transaction breakdown for those incidents.

Bitget Loss Estimate Rose After Investigations

Security firms SlowMist and Mandiant confirmed estimated losses totaling $387.5 million across 11 blockchains, according to the report. Bitget's initial estimate after the attack stood at $351.6 million, and the later assessment raised the reported total by $35.9 million — a gap that shows how loss figures can shift as outside security firms complete their own accounting across the affected chains.

The Bitget incident involved assets beyond ZEC, according to the reporting, meaning the exchange's reported losses should not be read as a Zcash-only figure. A separate report on a Bitget crypto theft also describes the exchange incident.

Crypto investigations can involve different allegations, victims, and amounts. In a separate case, prosecutors alleged a $328 million scheme involving Goliath Ventures, as detailed in coverage of a crypto Ponzi case. Another report described investors who lost money in the Key Coin Assets scheme. Those cases are not identified as connected to the Zcash transfers.

Bitget Announced One-Time Account Closures

Bitget announced on October 17 that it would discontinue services for certain customers, describing the move as a one-time account closure exercise affecting a subset of users. The report did not state how many accounts would be closed and did not connect the closures to any particular Zcash transfers.

The article also reported an estimated $90 million in cryptocurrency stolen after spyware was implanted in some Ledger wallets. Reports said Ledger had received warnings about wallet tampering months before the losses came to light. The source does not establish that those wallet incidents were part of the Bitget exploit.

Market figures in the report placed ZEC at $1,142.98, down 3.7% over 24 hours, with CoinGecko's displayed range spanning $1,132.57 to $1,190.18. The same data listed a $19.425 billion market capitalization and $664.152 million in daily trading volume. The price snapshot provides market context but does not establish that the reported transfers caused the decline.

For now, the account identifies transfers and reported losses but leaves the additional actors unnamed. The source provides no transaction-level detail or investigative outcome for the Cryptobills Ledger and Triple-A movements, so updated disclosures from the analysts would be needed before either can be sized or attributed.