Key Takeaways:
Onchain investigator ZachXBT identified 15 cases totaling over $420M in illicit USDC flows Circle failed to freeze promptly since 2022. The Drift Protocol exploit saw 232M USDC bridged via Circle’s own CCTP over 6 hours with no freeze during U.S. business hours. Circle froze 16 legitimate business wallets in a March 2026 civil case, including DFINITY Foundation’s ckETH Minter contract, with 5 later unfrozen.
Did Circle Fail to Freeze Stolen USDC? ZachXBT Says Yes, With Receipts
The thread, titled “Welcome to the Circle USDC files,” was posted to X and laid out specific hacks, frauds, and North Korea-linked theft cases where Circle held the technical ability and contractual authority to freeze or blacklist USDC wallets but did not act promptly, or at all. ZachXBT cited onchain addresses, transaction timelines, and communications involving law enforcement, victims, and private-sector security firms.
Among the cases, ZachXBT flagged the April 1, 2026, Drift Protocol exploit, attributed to North Korea’s Lazarus Group by blockchain analytics firm Elliptic, as a standout example. Attackers bridged more than 232 million USDC from Solana to Ethereum using Circle’s own Cross-Chain Transfer Protocol in over 100 transactions across six hours during U.S. business hours. Circle made no freeze.
ZachXBT’s post highlights the Swapnet exploit from January 25, 2026, which saw $16 million stolen, with 3 million USDC sitting accessible for two days while law enforcement and private investigators submitted temporary freeze requests that Circle denied. The funds were swapped before a court order could be obtained.
In the Cetus Protocol hack from May 22, 2025, attackers took $223 million and bridged 61 million USDC via Circle’s infrastructure over 90 minutes. Circle blacklisted the funds one month later, after they had already been converted to Ether.
ZachXBT also pointed to the Mango Markets exploit from October 2022, where $57.5 million was routed through a Circle deposit address and never frozen onchain. The exploiter was later charged by the U.S. Securities and Exchange Commission (SEC). In the Nomad Bridge hack from August 2022, approximately $45 million USDC sat freezable for 30 to 45 minutes following a $190 million breach. He says Circle did not act.
The investigator noted Circle took 4.5 months longer than Tether, Paxos, and other stablecoin issuers to freeze Lazarus Group-linked addresses flagged in an April 2024 report. He also documented delayed responses involving Garantex, the sanctioned Russian exchange, where over 200,000 USDC went untouched while Tether froze $22 million in a parallel action.
Circle’s official position, delivered through spokesperson statements to the media, holds that the company freezes assets only when legally required, including in response to sanctions designations, law enforcement orders, or court mandates. The company says preemptive freezes without legal authorization expose Circle to liability and infringe on user rights. Its terms of service permit discretionary action, but the company’s practice prioritizes formal legal process.
ZachXBT acknowledged Circle builds quality products and said he personally holds USDC. His criticism centers on whether Circle’s compliance priorities match the losses the broader crypto ecosystem absorbs when freezes are delayed or withheld.
Legitimate Operations Frozen
A separate incident amplified the criticism. On or around March 23, 2026, Circle froze USDC balances in 16 unrelated business wallets tied to a sealed U.S. civil case in New York, identified as approximately case 26-cv-2327. The wallets belonged to crypto exchanges, online casinos, forex brokers, payment processors, and the ckETH Minter smart contract operated by the DFINITY Foundation, which bridges the Internet Computer Protocol to Ethereum.
ZachXBT called it potentially the single most incompetent freeze he had witnessed in more than five years of investigations. He said basic onchain analysis would have shown the wallets were active operational infrastructure with no apparent connections to each other or to the underlying civil matter.
At least five of the 16 wallets were later unfrozen, including DFINITY’s contract and Goated.com’s wallet holding roughly $131,000 USDC. More reversals were expected as of the time of reporting. Circle issued no detailed public rebuttal to the full thread as of April 4, 2026.
The cases collectively raise direct questions about how a U.S.-regulated stablecoin issuer headquartered in New York weighs legal caution against real-world losses from illicit activity its infrastructure helps move.
