Onchain investigator ZachXBT has published a detailed public thread accusing Circle, the issuer of USDC, of significant compliance failures related to more than $420 million in illicit stablecoin flows that the company allegedly failed to freeze across 15 documented cases since 2022. Additionally, Circle froze 16 unrelated legitimate business wallets in a March 2026 civil case, including the DFINITY Foundation's ckETH Minter contract, which has sparked further criticism of the firm's operational practices.
Key Findings: Missed Freeze Opportunities
ZachXBT's thread, titled "Welcome to the Circle USDC files," was posted on X and laid out specific incidents covering hacks, frauds, and North Korea-linked thefts. In each case, Circle held the technical ability and contractual authority to freeze or blacklist USDC wallets but failed to act promptly, or at all. The investigator cited onchain addresses, transaction timelines, and communications involving law enforcement, victims, and private-sector security firms.
The April 1, 2026, Drift Protocol exploit, attributed to North Korea's Lazarus Group by blockchain analytics firm Elliptic, stands out as a prominent example. Attackers bridged more than 232 million USDC from Solana to Ethereum using Circle's own Cross-Chain Transfer Protocol in over 100 transactions across six hours during U.S. business hours. Circle made no freeze.
Another case highlighted is the Swapnet exploit from January 25, 2026, which saw $16 million stolen, with 3 million USDC sitting accessible for two days. Law enforcement and private investigators submitted temporary freeze requests that Circle denied, and the funds were swapped before a court order could be obtained. In the Cetus Protocol hack from May 22, 2025, attackers took $223 million and bridged 61 million USDC via Circle's infrastructure over 90 minutes. Circle blacklisted the funds one month later, after they had already been converted to Ether.
ZachXBT also pointed to the Mango Markets exploit from October 2022, where $57.5 million was routed through a Circle deposit address and never frozen onchain. The exploiter was later charged by the U.S. Securities and Exchange Commission (SEC). In the Nomad Bridge hack from August 2022, approximately $45 million USDC sat freezable for 30 to 45 minutes following a $190 million breach. Circle did not act.
The investigator noted that Circle took 4.5 months longer than Tether, Paxos, and other stablecoin issuers to freeze Lazarus Group-linked addresses flagged in an April 2024 report. He also documented delayed responses involving Garantex, the sanctioned Russian exchange, where over 200,000 USDC went untouched while Tether froze $22 million in a parallel action.
Legitimate Wallets Mistakenly Frozen
A separate incident amplified the criticism. On or around March 23, 2026, Circle froze USDC balances in 16 unrelated business wallets tied to a sealed U.S. civil case in New York, identified as approximately case 26-cv-2327. The wallets belonged to crypto exchanges, online casinos, forex brokers, payment processors, and the ckETH Minter smart contract operated by the DFINITY Foundation, which bridges the Internet Computer Protocol to Ethereum.
ZachXBT called it potentially the single most incompetent freeze he had witnessed in more than five years of investigations. He said basic onchain analysis would have shown the wallets were active operational infrastructure with no apparent connections to each other or to the underlying civil matter. At least five of the 16 wallets were later unfrozen, including DFINITY's contract and Goated.com's wallet holding roughly $131,000 USDC. More reversals were expected as of the time of reporting. Circle issued no detailed public rebuttal to the full thread as of April 4, 2026.
Circle's Stance and Industry Implications
Circle's official position, delivered through spokesperson statements to the media, holds that the company freezes assets only when legally required, including in response to sanctions designations, law enforcement orders, or court mandates. The company says preemptive freezes without legal authorization expose Circle to liability and infringe on user rights. Its terms of service permit discretionary action, but the company's practice prioritizes formal legal process.
ZachXBT acknowledged Circle builds quality products and said he personally holds USDC. His criticism centers on whether Circle's compliance priorities match the losses the broader crypto ecosystem absorbs when freezes are delayed or withheld. The cases collectively raise direct questions about how a U.S.-regulated stablecoin issuer headquartered in New York weighs legal caution against real-world losses from illicit activity its infrastructure helps move.