ZachXBT Accuses Circle of Delays in Freezing $420M in Illicit USDC Funds

ZachXBT's Investigation: 15 Cases of Circle Inaction

Prominent blockchain investigator ZachXBT has released a comprehensive report scrutinizing Circle, the issuer of the USDC stablecoin. According to his findings, the company has systematically delayed freezing funds linked to illicit activity since 2022, with the total amount exceeding $420 million across 15 documented incidents.

"1/ Welcome to the Circle $USDC files. $420M+ in alleged compliance failures since 2022, including fifteen cases of the US-regulated stablecoin issuer taking minimal action against illicit funds." — ZachXBT (@zachxbt), original post

The investigator compiled evidence showing that Circle, despite having the technical capability to blacklist addresses at the smart contract level, repeatedly failed to deploy this mechanism in a timely manner.

Why This Matters

USDC is one of the largest regulated stablecoins in the market. The issuer's ability to freeze tokens at any address serves as a critical tool for combating money laundering and illicit finance. When this mechanism is not activated promptly, attackers gain a window to move and convert stolen assets, making subsequent recovery virtually impossible. ZachXBT's investigation raises serious questions about the effectiveness of Circle's compliance procedures despite its regulated status in the United States.

The Drift Protocol Hack — The Largest Case

The most prominent example in the report involves the recent $280 million hack of DeFi project Drift Protocol. According to ZachXBT, the attacker leveraged Circle's Cross-Chain Transfer Protocol (CCTP) to move approximately 232 million USDC from Solana to Ethereum across more than 100 transactions over a six-hour period.

Throughout this time, the hacker was freely laundering funds through Circle's native cross-chain bridge without a single USDC being frozen. Analysts from Diverg, TRM Labs, and Elliptic subsequently attributed the attack to the North Korean hacking group Lazarus.

Additional Incidents: From Nomad Bridge to Cetus

The investigation highlights several other episodes where Circle's response was either delayed or entirely absent:

• Nomad Bridge (August 2022) — Circle had a 30-45 minute window to freeze $45 million drained from the protocol but failed to act.
• SwapNet (January 2026) — Attackers spent several hours moving $13 million in stolen funds. Circle ignored requests from on-chain researchers.
• Cetus (May 2025) — The protocol suffered a $223 million exploit. The hacker used CCTP to transfer 61 million USDC from Sui to Ethereum via more than 60 transactions over ninety minutes. Despite appeals from the Cetus team and independent security experts to freeze the address, Circle only blacklisted it a month later — after the funds had already been converted to ETH.

ZachXBT's Stance

The investigator emphasized that his report is not intended to undermine Circle as a company. He stated that Circle builds good products and that he personally holds USDC. However, the compliance decisions the company has made have had serious consequences for real people affected by hacks and fraud.

Previously, in March 2026, ZachXBT also criticized Circle for erroneously freezing 16 wallets as part of a civil lawsuit in the United States.