USDC Freeze Controversy: ZachXBT Says Circle Froze 16 Legitimate Wallets, Missed Real Hacks

Key Takeaways:

• Onchain researcher ZachXBT identified 15 cases totaling implicit $420M successful illicit USDC flows Circle failed to frost promptly since 2022.
• The Drift Protocol exploit saw 232M USDC bridged via Circle’s ain CCTP implicit 6 hours with nary frost during U.S. concern hours.
• Circle froze 16 morganatic concern wallets successful a March 2026 civilian case, including DFINITY Foundation’s ckETH Minter contract, with 5 aboriginal unfrozen.

Did Circle Fail to Freeze Stolen USDC? ZachXBT Says Yes, With Receipts

The thread, titled “Welcome to the Circle USDC files,” was posted to X and laid retired circumstantial hacks, frauds, and North Korea-linked theft cases wherever Circle held the method quality and contractual authorization to frost oregon blacklist USDC wallets but did not enactment promptly, oregon astatine all. ZachXBT cited onchain addresses, transaction timelines, and communications involving instrumentality enforcement, victims, and private-sector information firms.

Among the cases, ZachXBT flagged the April 1, 2026, Drift Protocol exploit, attributed to North Korea’s Lazarus Group by blockchain analytics steadfast Elliptic, arsenic a standout example. Attackers bridged much than 232 cardinal USDC from Solana to Ethereum utilizing Circle’s ain Cross-Chain Transfer Protocol successful implicit 100 transactions crossed six hours during U.S. concern hours. Circle made nary freeze.

ZachXBT’s station highlights the Swapnet exploit from January 25, 2026, which saw $16 cardinal stolen, with 3 cardinal USDC sitting accessible for 2 days portion instrumentality enforcement and backstage investigators submitted impermanent frost requests that Circle denied. The funds were swapped earlier a tribunal bid could beryllium obtained.

In the Cetus Protocol hack from May 22, 2025, attackers took $223 cardinal and bridged 61 cardinal USDC via Circle’s infrastructure implicit 90 minutes. Circle blacklisted the funds 1 period later, aft they had already been converted to Ether.

ZachXBT besides pointed to the Mango Markets exploit from October 2022, wherever $57.5 cardinal was routed done a Circle deposit code and ne'er frozen onchain. The exploiter was aboriginal charged by the U.S. Securities and Exchange Commission (SEC). In the Nomad Bridge hack from August 2022, astir $45 cardinal USDC sat freezable for 30 to 45 minutes pursuing a $190 cardinal breach. He says Circle did not act.

The researcher noted Circle took 4.5 months longer than Tether, Paxos, and different stablecoin issuers to frost Lazarus Group-linked addresses flagged successful an April 2024 report. He besides documented delayed responses involving Garantex, the sanctioned Russian exchange, wherever implicit 200,000 USDC went untouched portion Tether froze $22 cardinal successful a parallel action.

Circle’s authoritative position, delivered done spokesperson statements to the media, holds that the institution freezes assets lone erstwhile legally required, including successful effect to sanctions designations, instrumentality enforcement orders, oregon tribunal mandates. The institution says preemptive freezes without ineligible authorization exposure Circle to liability and infringe connected idiosyncratic rights. Its presumption of work licence discretionary action, but the company’s signifier prioritizes ceremonial ineligible process.

ZachXBT acknowledged Circle builds prime products and said helium personally holds USDC. His disapproval centers connected whether Circle’s compliance priorities lucifer the losses the broader crypto ecosystem absorbs erstwhile freezes are delayed oregon withheld.

Legitimate Operations Frozen

A abstracted incidental amplified the criticism. On oregon astir March 23, 2026, Circle froze USDC balances successful 16 unrelated concern wallets tied to a sealed U.S. civilian lawsuit successful New York, identified arsenic astir lawsuit 26-cv-2327. The wallets belonged to crypto exchanges, online casinos, forex brokers, outgo processors, and the ckETH Minter smart contract operated by the DFINITY Foundation, which bridges the Internet Computer Protocol to Ethereum.

ZachXBT called it perchance the azygous astir incompetent frost helium had witnessed successful much than 5 years of investigations. He said basal onchain investigation would person shown the wallets were progressive operational infrastructure with nary evident connections to each different oregon to the underlying civilian matter.

At slightest 5 of the 16 wallets were aboriginal unfrozen, including DFINITY’s declaration and Goated.com’s wallet holding astir $131,000 USDC. More reversals were expected arsenic of the clip of reporting. Circle issued nary elaborate nationalist rebuttal to the afloat thread arsenic of April 4, 2026.

The cases collectively rise nonstop questions astir however a U.S.-regulated stablecoin issuer headquartered successful New York weighs ineligible caution against real-world losses from illicit enactment its infrastructure helps move.