Key Takeaways:
Onchain investigator ZachXBT recognized 15 circumstances totaling over $420M in illicit USDC flows Circle didn’t freeze promptly since 2022. The Drift Protocol exploit noticed 232M USDC bridged by way of Circle’s personal CCTP over 6 hours with no freeze throughout U.S. enterprise hours. Circle froze 16 legit enterprise wallets in a March 2026 civil case, together with DFINITY Basis’s ckETH Minter contract, with 5 later unfrozen.
Did Circle Fail to Freeze Stolen USDC? ZachXBT Says Sure, With Receipts
The thread, titled “Welcome to the Circle USDC recordsdata,” was posted to X and laid out particular hacks, frauds, and North Korea-linked theft circumstances the place Circle held the technical capability and contractual authority to freeze or blacklist USDC wallets however didn’t act promptly, or in any respect. ZachXBT cited onchain addresses, transaction timelines, and communications involving regulation enforcement, victims, and private-sector safety corporations.
Among the many circumstances, ZachXBT flagged the April 1, 2026, Drift Protocol exploit, attributed to North Korea’s Lazarus Group by blockchain analytics agency Elliptic, as a standout instance. Attackers bridged greater than 232 million USDC from Solana to Ethereum utilizing Circle’s personal Cross-Chain Switch Protocol in over 100 transactions throughout six hours throughout U.S. enterprise hours. Circle made no freeze.
ZachXBT’s put up highlights the Swapnet exploit from January 25, 2026, which noticed $16 million stolen, with 3 million USDC sitting accessible for 2 days whereas regulation enforcement and personal investigators submitted short-term freeze requests that Circle denied. The funds have been swapped earlier than a courtroom order could possibly be obtained.
Within the Cetus Protocol hack from Could 22, 2025, attackers took $223 million and bridged 61 million USDC by way of Circle’s infrastructure over 90 minutes. Circle blacklisted the funds one month later, after they’d already been transformed to Ether.
ZachXBT additionally pointed to the Mango Markets exploit from October 2022, the place $57.5 million was routed via a Circle deposit handle and by no means frozen onchain. The exploiter was later charged by the U.S. Securities and Trade Fee (SEC). Within the Nomad Bridge hack from August 2022, roughly $45 million USDC sat freezable for 30 to 45 minutes following a $190 million breach. He says Circle didn’t act.
The investigator famous Circle took 4.5 months longer than Tether, Paxos, and different stablecoin issuers to freeze Lazarus Group-linked addresses flagged in an April 2024 report. He additionally documented delayed responses involving Garantex, the sanctioned Russian alternate, the place over 200,000 USDC went untouched whereas Tether froze $22 million in a parallel motion.
Circle’s official place, delivered via spokesperson statements to the media, holds that the corporate freezes property solely when legally required, together with in response to sanctions designations, regulation enforcement orders, or courtroom mandates. The corporate says preemptive freezes with out authorized authorization expose Circle to legal responsibility and infringe on consumer rights. Its phrases of service allow discretionary motion, however the firm’s follow prioritizes formal authorized course of.
ZachXBT acknowledged Circle builds high quality merchandise and mentioned he personally holds USDC. His criticism facilities on whether or not Circle’s compliance priorities match the losses the broader crypto ecosystem absorbs when freezes are delayed or withheld.
Legit Operations Frozen
A separate incident amplified the criticism. On or round March 23, 2026, Circle froze USDC balances in 16 unrelated enterprise wallets tied to a sealed U.S. civil case in New York, recognized as roughly case 26-cv-2327. The wallets belonged to crypto exchanges, on-line casinos, foreign exchange brokers, fee processors, and the ckETH Minter good contract operated by the DFINITY Basis, which bridges the Web Laptop Protocol to Ethereum.
ZachXBT referred to as it doubtlessly the one most incompetent freeze he had witnessed in additional than 5 years of investigations. He mentioned fundamental onchain evaluation would have proven the wallets have been energetic operational infrastructure with no obvious connections to one another or to the underlying civil matter.
At the least 5 of the 16 wallets have been later unfrozen, together with DFINITY’s contract and Goated.com’s pockets holding roughly $131,000 USDC. Extra reversals have been anticipated as of the time of reporting. Circle issued no detailed public rebuttal to the complete thread as of April 4, 2026.
The circumstances collectively elevate direct questions on how a U.S.-regulated stablecoin issuer headquartered in New York weighs authorized warning towards real-world losses from illicit exercise its infrastructure helps transfer.
