ZachXBT Investigation Report: Circle Multiple Failures in Compliance Actions, Involving Over $420 Million

BlockBeats message, April 3, on-chain investigator ZachXBT released an investigative report targeting Circle, saying that since 2022, the company has had issues with “inadequate compliance enforcement” in multiple incidents involving illegal funds, with a cumulative amount exceeding $420 million. The report notes that as the issuer of USDC, Circle has long been known for its regulated and well-developed compliance framework, and its token smart contracts also include the ability to freeze and blacklist addresses, with its Terms of Service explicitly reserving the right to impose restrictions on suspicious accounts. However, in multiple major security incidents, these mechanisms were not used promptly and effectively.

The report highlights in particular the Drift Protocol attack incident on April 1, 2026, in which about $280 million in assets were stolen. The attacker used Circle’s own cross-chain bridge CCTP to move more than $232 million in USDC from Solana to Ethereum within 6 hours, but no assets were frozen during that period. Similar situations also occurred in attack incidents involving SwapNet, Cetus Protocol, and Mango Markets. In some cases, even after law enforcement agencies and industry experts had already issued freeze requests, Circle still did not take action in a timely manner, and in some instances only processed it after the assets had already been transferred.

In addition, the report states that in investigations into money laundering involving the hacker group Lazarus Group, Circle’s response was noticeably slower than other stablecoin issuers (such as Tether, Paxos, etc.). In some cases, the freeze operation was delayed by as much as several months. Similar delays also appeared in the Ledger supply chain attack and the GMX attack incidents, where USDC remained on suspicious addresses for hours or longer, and still was not frozen.

In the report, ZachXBT said that this disclosure does not deny the value of Circle’s products or stablecoin itself, but emphasized that its compliance enforcement decisions have caused “real and substantial losses” to the industry. He noted that over the past three years, due to repeated failures to take timely action, the DeFi ecosystem’s cumulative losses have reached nine-figure amounts in USD, and that the $420 million figure is only a conservative tally of publicly known cases, with the actual scale potentially being higher.