Fee Payments Helped Trace a $103.4 Million Theft Through Zcash

Investigators traced an estimated $103.4 million theft from 530 addresses across seven blockchains by analyzing fee payments and transaction patterns around Zcash’s shielded transfers.

One Ethereum wallet paid gas fees for other wallets involved in moving funds, linking their activity. Investigators also matched batches of funds entering and leaving Zcash’s shielded pool. Those matches were analytical inferences: the shielded transfers concealed the sender, amount and recipient.

Visible transfers, fee payments and repeated patterns helped connect parts of the route without revealing the contents of Zcash’s protected transactions. The analysis described traces around the privacy tool, while its shielded transaction details remained concealed.

Ledger confirmed that affected devices were sold by Southeast Asian reseller CryptoBilis and that one contained an unauthorized hardware implant.

The estimated theft total has changed as investigators identified more addresses. In an Oct. 13 snapshot, wallets previously identified in the investigation held 16,220.58 Ether (ETH), valued at $40.43 million, and 203.79 Bitcoin (BTC), valued at $16.93 million. The snapshot covered a limited set of identified wallets, so it does not account for every destination in the investigation.

A separate on-chain count put the total at $102.0 million from 324 wallets as of its Oct. 12 update. The estimates differ in scope and update time.