Onchain investigator ZachXBT published a detailed thread this week, accusing Circle, the issuer of USDC, of compliance failures tied to more than $420 million in illicit stablecoin flows the firm allegedly failed to freeze across 15 documented cases since 2022.
The thread, titled “Welcome to the Circle USDC files,” was posted on X and laid out specific hacks, frauds, and North Korea-linked theft cases where Circle held the technical ability and contractual authority to freeze or blacklist USDC wallets but did not act promptly, or at all. ZachXBT cited onchain addresses, transaction timelines, and communications involving law enforcement, victims, and private-sector security firms.
Key Cases Highlighted
- Drift Protocol Exploit (April 1, 2026): Attributed to North Korea’s Lazarus Group by blockchain analytics firm Elliptic, attackers bridged more than 232 million USDC from Solana to Ethereum using Circle’s own Cross-Chain Transfer Protocol (CCTP) in over 100 transactions across six hours during U.S. business hours. Circle made no freeze.
- Swapnet Exploit (January 25, 2026): $16 million stolen, with 3 million USDC sitting accessible for two days while law enforcement and private investigators submitted temporary freeze requests that Circle denied. The funds were swapped before a court order could be obtained.
- Cetus Protocol Hack (May 22, 2025): Attackers took $223 million and bridged 61 million USDC via Circle’s infrastructure over 90 minutes. Circle blacklisted the funds one month later, after they had already been converted to Ether.
- Mango Markets Exploit (October 2022): $57.5 million was routed through a Circle deposit address and never frozen onchain. The exploiter was later charged by the U.S. Securities and Exchange Commission.
- Nomad Bridge Hack (August 2022): Approximately $45 million USDC sat freezable for 30 to 45 minutes following a $190 million breach. Circle did not act.
ZachXBT also noted Circle took 4.5 months longer than Tether, Paxos, and other stablecoin issuers to freeze Lazarus Group-linked addresses flagged in an April 2024 report. He also documented delayed responses involving Garantex, the sanctioned Russian exchange, where over 200,000 USDC went untouched while Tether froze $22 million in a parallel action.
Legitimate Wallets Frozen in Civil Case
On or around March 23, 2026, Circle froze USDC balances in 16 unrelated business wallets tied to a sealed U.S. civil case in New York, identified as approximately case 26-cv-2327. The wallets belonged to crypto exchanges, online casinos, forex brokers, payment processors, and the ckETH Minter smart contract operated by the DFINITY Foundation, which bridges the Internet Computer Protocol to Ethereum. ZachXBT called it potentially the single most incompetent freeze he had witnessed in more than five years of investigations, stating that basic onchain analysis would have shown the wallets were active operational infrastructure with no apparent connections to each other or to the underlying civil matter.
At least five of the 16 wallets were later unfrozen, including DFINITY’s contract and Goated.com’s wallet holding roughly $131,000 USDC. More reversals were expected as of the time of reporting. Circle issued no detailed public rebuttal to the full thread as of April 4, 2026.
Circle’s Official Stance
Circle’s official position, delivered through spokesperson statements to the media, holds that the company freezes assets only when legally required, including in response to sanctions designations, law enforcement orders, or court mandates. The company says preemptive freezes without legal authorization expose Circle to liability and infringe on user rights. Its terms of service permit discretionary action, but the company’s practice prioritizes formal legal process.
ZachXBT acknowledged Circle builds quality products and said he personally holds USDC. His criticism centers on whether Circle’s compliance priorities match the losses the broader crypto ecosystem absorbs when freezes are delayed or withheld. The cases collectively raise direct questions about how a U.S.-regulated stablecoin issuer headquartered in New York weighs legal caution against real-world losses from illicit activity its infrastructure helps move.