Circle, the issuer of USDC, is facing renewed scrutiny after onchain investigator ZachXBT alleged that the company failed to act quickly in multiple major crypto crime cases while later freezing a group of apparently legitimate business wallets. In a detailed thread posted this week, ZachXBT argued that Circle did not promptly freeze more than $420 million in illicit USDC flows across 15 documented cases since 2022. At the same time, he said Circle froze 16 unrelated operational wallets in connection with a sealed U.S. civil case in March 2026, raising questions about how the stablecoin issuer applies its compliance powers.
Allegations center on delayed or absent freezes
The thread, titled “Welcome to the Circle USDC files,” compiled examples involving hacks, frauds, and thefts linked in some instances to North Korean cyber actors. According to ZachXBT, Circle had both the technical means and the contractual authority to freeze or blacklist USDC in these cases, yet often failed to do so in time. His post cited wallet addresses, transaction timelines, and communications involving victims, law enforcement, and private security firms.
One of the most prominent examples was the April 1, 2026 exploit of Drift Protocol. ZachXBT pointed to reporting from blockchain analytics firm Elliptic, which attributed the attack to North Korea’s Lazarus Group. He said the attackers moved more than 232 million USDC from Solana to Ethereum through Circle’s own Cross-Chain Transfer Protocol (CCTP). The transfers reportedly took place in more than 100 transactions over six hours, during U.S. business hours, yet no freeze was imposed.
Another case highlighted in the thread was the January 25, 2026 Swapnet exploit. Roughly $16 million was stolen, and about $3 million in USDC remained accessible for two days. ZachXBT said temporary freeze requests were submitted by law enforcement and private investigators, but Circle allegedly declined to act before a court order was obtained. By the time legal process advanced, the funds had already been swapped away.
He also referenced the May 22, 2025 hack of Cetus Protocol, where attackers stole around $223 million and bridged $61 million in USDC using Circle-related infrastructure over roughly 90 minutes. According to the thread, Circle blacklisted the funds one month later, after the USDC had already been converted into ether.
Earlier incidents were included as well. ZachXBT said that during the October 2022 Mango Markets exploit, approximately $57.5 million passed through a Circle deposit address without an onchain freeze. He also cited the August 2022 Nomad Bridge hack, where around $45 million in USDC was allegedly still freezable for 30 to 45 minutes after a broader $190 million breach, but no action followed.
Comparisons with other stablecoin issuers
Beyond individual hacks, ZachXBT argued that Circle has sometimes moved more slowly than competing issuers when handling addresses associated with sanctions or cybercrime. He said Circle took 4.5 months longer than Tether, Paxos, and other stablecoin issuers to freeze addresses linked to Lazarus Group that had been flagged in an April 2024 report. He also mentioned delayed action in cases involving Garantex, the sanctioned Russian exchange, where more than 200,000 USDC allegedly remained untouched while Tether froze $22 million in a parallel enforcement move.
The broader criticism is not that Circle lacks compliance controls, but that it may apply them too narrowly or too slowly when criminal funds are moving rapidly across chains. Because USDC is centrally issued and can be blacklisted at the token level, the timing of intervention can determine whether victims have any realistic chance of recovery.
Circle’s legal-first response
Circle’s public stance, conveyed through spokesperson comments to the media, is that the company freezes funds only when legally required to do so. That includes sanctions designations, law enforcement orders, and court mandates. Circle has argued that freezing assets preemptively, without sufficient legal authorization, can expose the company to liability and may violate user rights.
That position reflects a central tension for regulated stablecoin issuers. On one hand, they operate critical infrastructure capable of stopping illicit flows in real time. On the other, they are expected to avoid arbitrary intervention and respect due process. Circle’s terms of service may provide room for discretionary action, but the company appears to prioritize formal legal process over proactive freezing.
ZachXBT acknowledged that Circle has built strong products and said he personally holds USDC. His criticism was therefore not framed as a rejection of the asset itself, but as a challenge to Circle’s policy choices. In his view, the company’s compliance posture may not align with the speed and scale of losses that the crypto ecosystem faces when stolen funds move through stablecoins.
Separate incident involved 16 legitimate business wallets
The controversy intensified because ZachXBT paired the delayed-freeze allegations with a separate case in which Circle allegedly froze wallets that appeared unrelated to wrongdoing. Around March 23, 2026, Circle froze USDC balances in 16 business wallets connected to a sealed civil case in New York, identified approximately as 26-cv-2327.
According to the report, the affected wallets belonged to a mix of businesses including crypto exchanges, online casinos, forex brokers, payment processors, and the ckETH Minter smart contract operated by the DFINITY Foundation. That contract is part of infrastructure linking the Internet Computer Protocol with Ethereum. ZachXBT argued that even basic onchain review would have shown that these wallets were active operational accounts with no obvious relationship to one another or to the underlying civil litigation.
He described the action as potentially the most incompetent freeze he had seen in more than five years of investigations. The criticism here was the opposite of the earlier complaints: not that Circle was too slow, but that when it did act, it allegedly did so too broadly and without sufficient analytical care.
At least five of the 16 wallets were later unfrozen, including DFINITY’s contract and a wallet tied to Goated.com that reportedly held about $131,000 in USDC. More reversals were expected at the time of reporting. As of April 4, 2026, Circle had not issued a detailed public rebuttal responding point by point to the full thread.
Why the dispute matters
The episode highlights a structural issue in the stablecoin market: centralized issuers can both support law enforcement and disrupt lawful activity. That makes policy consistency especially important. If freezes come too late, illicit actors may cash out before intervention. If freezes are too broad or poorly targeted, legitimate businesses can lose access to funds and operational continuity.
For Circle, the criticism lands at a sensitive moment for the broader digital asset industry, where stablecoins are increasingly viewed as systemically important payment rails. USDC is often marketed as a regulated, transparent, and institution-friendly dollar token. Those same qualities create higher expectations around precision, responsiveness, and accountability in enforcement decisions.
The dispute also underscores a wider debate about the role of private issuers in policing blockchain activity. Unlike decentralized assets, fiat-backed stablecoins sit at the intersection of public blockchains and traditional legal systems. Their issuers must make judgment calls about when to intervene, what legal threshold is sufficient, and how to balance user protections against urgent criminal risk.
Whether ZachXBT’s allegations lead to a formal response or policy change remains to be seen. But the thread has already sharpened an uncomfortable question for Circle and for the stablecoin sector more broadly: when an issuer has the power to freeze, what standard should govern when it acts, when it waits, and when it gets the call wrong?