ZachXBT report alleges over $420 million in USDC compliance lapses, prompting questions over Circle's enforcement

An on-chain report by ZachXBT has raised questions about how effectively Circle enforces its compliance controls. The investor cited more than $420m in alleged lapses linked to illicit fund flows since 2022. The findings, shared on 3 April, compile multiple incidents in which USDC tied to hacks or illicit activity was not frozen or was frozen only after significant delays. Regulators have not independently verified the claims, and Circle had not publicly responded to the report at the time of writing.

Drift exploit highlights alleged response-time gaps

The report points to the recent $280m exploit of Drift Protocol as a key example. ZachXBT said the attacker bridged more than $232m in USDC from Solana to Ethereum over several hours using Circle’s Cross-Chain Transfer Protocol (CCTP).

Despite the scale and duration of the activity, the report alleges that no USDC was frozen during the window. It also says the attacker has been linked to North Korean actors by blockchain analytics firm Elliptic, though that attribution has not been confirmed by authorities.

Historical cases cited for delayed or absent freezes

Beyond the Drift incident, the report highlights several earlier cases involving major exploits:

• $223m Cetus Protocol exploit (2025): USDC was frozen weeks after initial requests.
• $110m Mango Markets exploit (2022): funds were allegedly not frozen despite known links to the attacker.
• $190m Nomad Bridge hack: USDC remained in exploiter wallets during the early stages of the incident.

In multiple instances, the report claims that other stablecoin issuers, including Tether, acted more quickly to freeze funds linked to the same addresses.

Compliance controls exist, but enforcement is questioned

Circle markets USDC as a regulated stablecoin with built-in compliance features, including the ability to freeze or blacklist addresses linked to illicit activity. Its terms of service state that the company may restrict access to funds “at its sole discretion,” giving it authority to act when suspicious activity is identified.

The report does not dispute the existence of these controls, but questions their consistent application—particularly in fast-moving exploit scenarios where funds are rapidly bridged or swapped across chains.

Implications for stablecoin oversight

The allegations come as stablecoins are increasingly positioned as core financial infrastructure, with regulators in the United States, Canada, and Europe advancing frameworks to govern their use.

If substantiated, the findings could increase pressure on issuers to demonstrate not only that compliance tools exist, but that they can be deployed effectively in real time. The report also underscores operational challenges in monitoring and responding to illicit activity across fragmented, cross-chain environments.

Summary

ZachXBT’s report alleges more than $420m in USDC-linked compliance lapses, though the claims remain unverified. The findings raise broader questions about how effectively stablecoin issuers can enforce controls in fast-moving exploit scenarios.