Zcash has become a preferred destination for threat actors moving stolen cryptocurrency, according to on-chain security analysts and blockchain investigators. The privacy-focused network's shielded transactions are being used to obscure the source of illicit funds from several recent exploits.
The scrutiny intensified after blockchain investigator ZachXBT disclosed that the attacker behind the September Bitget exploit used Zcash to shield stolen assets. On-chain analyst Specter later reported that additional threat actors had begun channeling proceeds into ZEC, including funds from the Cryptobills Ledger crypto scam and the $12 million Triple-A exploit.
ZachXBT stated that approximately 18,900 ZEC were stolen from a hot wallet on September 24, 2026, valued at around $28.3 million. The attacker reportedly began shielding about 2,700 ZEC through Zcash's Ironwood pool, worth roughly $3.8 million. Across the full incident, security firms SlowMist and Mandiant confirmed estimated losses totaling $387.5 million across 11 blockchains, up from Bitget's initial estimate of $351.6 million.
Following the exploit, Bitget announced on October 17 that it would discontinue services for certain customers in a one-time account closure exercise. Separately, spyware implanted in some Ledger wallets reportedly contributed to approximately $90 million in stolen cryptocurrency.
Market data showed ZEC trading at $1,142.98, down 3.7% over 24 hours. Zcash's market capitalization stood at $19.425 billion, with daily trading volume of $664.152 million and perpetual open interest of $3.511 billion. Longer-term performance showed declines of 5.7% over seven days, 10.8% over fourteen days, and 15.3% over thirty days, despite a one-year gain of 441.2%.
The growing use of Zcash for laundering stolen assets may draw increased regulatory attention to privacy coins and anti-money laundering enforcement, potentially affecting legitimate usage and market sentiment.
