USDC Freeze Controversy: ZachXBT Claims Circle Failed to Freeze 16 Legitimate Wallets and Missed Real Hacks

Onchain investigator ZachXBT says Circle failed to freeze stolen USDC promptly in multiple high-profile incidents, despite having both the technical ability and contractual authority to do so. In a post shared on X titled “Welcome to the Circle USDC files,” ZachXBT cited onchain addresses, transaction timelines, and communications involving law enforcement, victims, and private-sector security firms.

Key cases cited by ZachXBT

ZachXBT said he identified 15 cases totaling over $420 million in illicit USDC flows in which Circle did not freeze promptly, or at all. He pointed to several incidents where attackers moved funds during periods when, according to his timeline, freeze requests were not acted on.

Drift Protocol exploit (April 1, 2026)

ZachXBT highlighted the April 1, 2026, Drift Protocol exploit, attributed to North Korea’s Lazarus Group by blockchain analytics firm Elliptic. He said attackers bridged more than 232 million USDC from Solana to Ethereum using Circle’s Cross-Chain Transfer Protocol (CCTP) over more than 100 transactions across six hours during U.S. business hours, and that Circle made no freeze.

Swapnet exploit (January 25, 2026)

In the Swapnet exploit, ZachXBT said $16 million was stolen. He added that about 3 million USDC remained accessible for two days while law enforcement and private investigators submitted temporary freeze requests that Circle denied. He said the funds were swapped before a court order could be obtained.

Cetus Protocol hack (May 22, 2025)

ZachXBT said the Cetus Protocol hack involved attackers taking $223 million and bridging 61 million USDC via Circle’s infrastructure over about 90 minutes. He said Circle blacklisted the funds one month later, after they had already been converted to Ether.

Mango Markets exploit (October 2022)

For the Mango Markets exploit in October 2022, ZachXBT said $57.5 million was routed through a Circle deposit address and was never frozen onchain. He noted that the exploiter was later charged by the U.S. Securities and Exchange Commission (SEC).

Nomad Bridge hack (August 2022)

ZachXBT also cited the Nomad Bridge hack from August 2022, saying approximately $45 million USDC sat freezable for 30 to 45 minutes following a $190 million breach, and that Circle did not act.

Freeze timing and comparisons to other issuers

ZachXBT said Circle took 4.5 months longer than Tether, Paxos, and other stablecoin issuers to freeze Lazarus Group-linked addresses flagged in an April 2024 report. He also described delayed responses involving Garantex, a sanctioned Russian exchange, where he said over 200,000 USDC went untouched while Tether froze $22 million in a parallel action.

Circle’s response

Circle’s official position, delivered through spokesperson statements to the media, is that it freezes assets only when legally required, including in response to sanctions designations, law enforcement orders, or court mandates. The company said preemptive freezes without legal authorization could expose it to liability and infringe on user rights, while its terms of service allow discretionary action but its practice prioritizes formal legal process.

ZachXBT acknowledged that Circle builds quality products and said he personally holds USDC. His criticism focuses on whether Circle’s compliance priorities align with the losses the broader crypto ecosystem absorbs when freezes are delayed or withheld.

Legitimate wallets frozen in March 2026 civil case

A separate incident amplified the criticism. On or around March 23, 2026, Circle froze USDC balances in 16 unrelated business wallets tied to a sealed U.S. civil case in New York, identified as approximately case 26-cv-2327.

ZachXBT said the wallets belonged to crypto exchanges, online casinos, forex brokers, payment processors, and the ckETH Minter smart contract operated by the DFINITY Foundation, which bridges the Internet Computer Protocol to Ethereum. He called it potentially the single most incompetent freeze he had witnessed in more than five years of investigations, saying basic onchain analysis would have shown the wallets were active operational infrastructure with no apparent connections to each other or to the underlying civil matter.