Circle under fire as ZachXBT flags $420 million in USDC cases

Blockchain investigator ZachXBT has accused Circle of failing to freeze USDC connected to alleged illicit activity totaling more than $420 million. In a public thread on X, he laid out 15 cases and questioned how quickly the company responded to requests to halt funds. Circle said it complies with legal orders and freezes assets when required by law.

Alleged enforcement gaps across USDC

ZachXBT argued that several exploits exposed weaknesses in Circle’s enforcement actions across its USDC stablecoin infrastructure. He said Circle markets USDC as a safer and regulated alternative to Tether’s USDT, and he linked compliance decisions to consequences for affected users.

He said the $420 million figure covers only major public incidents and wrote that the real total is likely higher.

Drift Protocol exploit: $280 million-plus

ZachXBT highlighted the Drift Protocol exploit reported this week, which he said totaled more than $280 million. He stated that the exploiter bridged about $232 million in USDC from Solana to Ethereum.

According to ZachXBT, the attacker used Circle’s Cross-Chain Transfer Protocol across more than 100 transactions over six hours, and he said Circle did not freeze the USDC during that period.

He added that more than 10 decentralized finance protocols on Solana were indirectly impacted by the exploit. ZachXBT also claimed the attacker laundered funds openly across Circle’s native bridge.

Cetus Protocol exploit: $223 million

ZachXBT also referenced the Cetus Protocol exploit from May, which he valued at $223 million. He said the exploiter bridged 61 million USDC from Sui to Ethereum within 90 minutes.

He wrote that both the Cetus team and private experts asked Circle to freeze the theft address. ZachXBT said Circle blacklisted the address one month later, and that the USDC had already been converted to ETH by the time Circle acted.

He described the delay as a repeated pattern across multiple cases.

Analytics links and Circle’s response

Blockchain analytics firm Elliptic linked the Drift exploit to indicators associated with North Korea. Elliptic said it identified signs suggesting involvement by the Democratic People’s Republic of Korea. ZachXBT did not attribute the attack directly, but referenced the analytics findings and said stronger coordination across platforms could reduce future incidents.

Circle responded to the claims in a statement to The Block. A spokesperson said, “Circle is a regulated company that complies with sanctions, law enforcement orders, and court-mandated requirements.”

The company added that it freezes assets when legally required and protects user rights and privacy.

Scale of USDC and regulatory push

USDC is the world’s second-largest stablecoin, with more than $77 billion in circulating supply. Circle has called for clearer United States regulations to support adoption.

Earlier this year, ZachXBT joined the crypto investment firm Paradigm as an incident response advisor.