Onchain investigator ZachXBT has published a detailed exposé accusing Circle, the issuer of USDC, of systemic compliance failures, alleging the company failed to freeze over $420 million in illicit stablecoin flows across 15 documented cases since 2022, while simultaneously freezing 16 legitimate business wallets in a separate March 2026 civil matter.
Key Cases: $420M in Illicit Flows Left Unfrozen
In a thread titled “Welcome to the Circle USDC files” posted to X, ZachXBT outlined specific hacks, frauds, and North Korea-linked thefts where Circle held both the technical ability and contractual authority to freeze or blacklist USDC wallets but did not act promptly or at all. He cited onchain addresses, transaction timelines, and communications involving law enforcement, victims, and private-sector security firms.
The most striking example is the Drift Protocol exploit on April 1, 2026, attributed to North Korea’s Lazarus Group by blockchain analytics firm Elliptic. Attackers bridged over 232 million USDC from Solana to Ethereum using Circle’s own Cross-Chain Transfer Protocol (CCTP) in more than 100 transactions over six hours during U.S. business hours. Circle made no freeze.
The Swapnet exploit on January 25, 2026, saw $16 million stolen, with 3 million USDC sitting accessible for two days while law enforcement and private investigators submitted temporary freeze requests that Circle denied. The funds were swapped before a court order could be obtained.
In the Cetus Protocol hack from May 22, 2025, attackers took $223 million and bridged 61 million USDC via Circle’s infrastructure over 90 minutes. Circle blacklisted the funds one month later, after they had already been converted to Ether.
ZachXBT also pointed to the Mango Markets exploit (October 2022, $57.5 million routed through a Circle deposit address, never frozen onchain) and the Nomad Bridge hack (August 2022, approximately $45 million USDC sat freezable for 30-45 minutes after a $190 million breach). He noted Circle took 4.5 months longer than Tether, Paxos, and other stablecoin issuers to freeze Lazarus Group-linked addresses flagged in an April 2024 report. Delayed responses also involved Garantex, the sanctioned Russian exchange, where over 200,000 USDC went untouched while Tether froze $22 million in a parallel action.
Legitimate Operations Frozen
A separate incident amplified criticism. On or around March 23, 2026, Circle froze USDC balances in 16 unrelated business wallets tied to a sealed U.S. civil case in New York (Case No. 26-cv-2327). The wallets belonged to crypto exchanges, online casinos, forex brokers, payment processors, and the ckETH Minter smart contract operated by the DFINITY Foundation (bridging the Internet Computer Protocol to Ethereum).
ZachXBT called it potentially the single most incompetent freeze he had witnessed in more than five years of investigations. He stated that basic onchain analysis would have shown the wallets were active operational infrastructure with no apparent connections to each other or to the underlying civil matter.
At least five of the 16 wallets have since been unfrozen, including DFINITY’s contract and Goated.com’s wallet holding roughly $131,000 USDC. More reversals were expected as of the time of reporting.
Circle’s Stance and Broader Implications
Circle’s official position, delivered through spokesperson statements, maintains that the company freezes assets only when legally required—in response to sanctions designations, law enforcement orders, or court mandates. The company argues that preemptive freezes without legal authorization expose Circle to liability and infringe on user rights. Its terms of service permit discretionary action, but the company’s practice prioritizes formal legal process.
ZachXBT acknowledged Circle builds quality products and said he personally holds USDC. His criticism centers on whether Circle’s compliance priorities match the losses the broader crypto ecosystem absorbs when freezes are delayed or withheld. The cases collectively raise direct questions about how a U.S.-regulated stablecoin issuer headquartered in New York weighs legal caution against real-world losses from illicit activity its infrastructure helps move.