Hackers are increasingly turning to Zcash (ZEC) to launder stolen cryptocurrency. According to renowned Web3 security researcher Specter, funds stolen in the recent Ledger supply chain attack — a type of breach in which attackers compromise trusted software or its update channels to reach end users — along with $12 million taken from the payment firm Triple-A, have been moved into a Zcash shielded pool.

"Threat actors are actively using $ZEC to move stolen funds. Stay smart," Specter warned.

ZachXBT Flags North Korean Actors Using Zcash

In late September, Zachary Wolk, a prominent security researcher and on-chain investigator known on X as ZachXBT, flagged North Korean threat actors' use of Zcash. North Korean-linked hacking units have been blamed for some of the largest cryptocurrency thefts on record, which is why their laundering routes draw close attention from on-chain investigators. Wolk found that out of the $28.3 million in ZEC stolen in the Bitget exploit, the hackers moved about $4 million into Ironwood's shielded pool.

Wolk also cast doubt on Zcash's prior virtue signaling, stating:

"One of the arguments used by competing privacy projects that threat actors do not use $ZEC, thus XYZ is better."

Zcash has emerged as a top privacy alternative and has drawn support from many Bitcoin OGs, including serial investor Naval Ravikant, who called it "insurance against Bitcoin." The question now is whether Zcash will suffer Monero's fate as criminals increasingly use it to launder stolen funds.

Why Privacy Pools Complicate Tracing

Monero offers privacy features by default, and the recipient's true public wallet address is never revealed. Zcash, by contrast, treats privacy as optional: users can opt in by shielding funds through Ironwood and other pools. In practice, Zcash can be traced in some instances, but not once funds enter shielded pools.

Monero offers no traceability at all, which turned it into a haven for criminals seeking to bypass freezing and seizures on centralized exchanges. That is why Monero was delisted from Binance and other platforms, and was even banned in the EU.

Stablecoins can currently be seized and frozen, and issuers Tether and Circle have been doing so for some time. Similarly, coordinated industry efforts can readily freeze funds — whether BTC or other crypto assets — once they land on centralized platforms, as part of the anti-money laundering (AML) compliance mandated by several jurisdictions.

That leaves decentralized crypto mixers and privacy platforms, such as Thorchain, Tornado Cash, and Zcash, among others, as alternative channels for laundering stolen funds. These are effectively the only ways hackers can bypass seizures and freezes. Regulators have previously targeted such tools directly — the U.S. Treasury sanctioned Tornado Cash in 2022. Unlike centralized platforms, most privacy platforms do not screen against sanctioned addresses, making it impossible to distinguish legitimate funds from stolen ones.

As of writing, ZEC's shielded supply has increased by 16% since July, rising from 4.3 million ZEC to 4.96 million ZEC — meaning a growing share of the token's supply now sits beyond the reach of standard on-chain tracing.

Impact on ZEC Sentiment

Like Monero, Zcash will likely face regulatory scrutiny and pressure if it becomes a major laundering node for stolen crypto funds. ZEC's market sentiment soured further after the update, dipping to a "fear" level of 28. It remains unclear whether ZEC will slip below $1,000 if regulatory and broader market pressure deepens. Key indicators to watch from here include whether ZEC's shielded supply keeps expanding, whether major exchanges tighten their handling of ZEC deposits from shielded addresses, and whether regulators pursue Monero-style delistings or restrictions.

Summary

• Some of the stolen funds from the Ledger, Bitget, and Triple-A incidents are being hidden in ZEC shielded pools.
• ZEC's shielded supply has increased 16% since July, and the stolen funds remain untraceable.

Original report: AMBCrypto