American stablecoin giant Circle has recently fallen into a public-opinion storm. Well-known on-chain investigator ZachXBT released a major investigation, accusing the company of failing to effectively freeze USDC funds related to hacker attacks and sanctions targets over the past several years, with a cumulative amount exceeding $420 million.
The investigation quickly caught fire within the crypto community. It not only sparked doubts about USDC’s compliance mechanisms, but also reignited the long-running debate in the market over the “responsibility boundaries of centralized stablecoins.”
ZachXBT leaks: USDC in multiple major cases failed to freeze funds in time
According to the investigation ZachXBT published on April 3, 2026, since 2022, Circle has failed to effectively freeze suspicious funds in at least 15 major security incidents, with a cumulative amount exceeding $420 million.
He pointed out that, as a centralized stablecoin issued by Circle and pegged 1:1 to the U.S. dollar, USDC’s smart contracts themselves include “freezing and blacklisting” functionality, and the company’s terms also clearly reserve the right to restrict suspicious addresses. However, in practice, there have been multiple delays, or even cases where no action was taken at all.
ZachXBT emphasized that the $420 million figure is based only on statistics from publicly known cases, and the actual number could be far higher—showing the problem is not an isolated incident, but a systemic flaw.
Drift Protocol hack case as the trigger: no action taken within a 6-hour window
The core case behind this controversy was the Drift Protocol attack event that occurred on April 1, 2026. The incident caused losses of about $280 million, including more than $232 million worth of USDC that, via Circle’s own cross-chain protocol CCTP, was transferred in batches to Ethereum within six hours.
Even more controversial is that although a blockchain analytics company connected the attacker to the North Korean hacking organization Lazarus Group, throughout the entire fund-transfer process, Circle took no freezing measures.
ZachXBT questioned this: “Circle had a full six hours to freeze funds, but chose to stay silent.” This case is also seen as a typical snapshot of slow USDC compliance responses.
Multiple historical cases reveal the freezing pattern of “delay or absence”
In addition to the latest incident, the investigation also compiled multiple major cases from the past few years, showing a similar pattern:
In the SwapNet attack in January 2026, about $16 million was stolen, including $3 million in USDC that remained in a freeze-able state for two days, but was ultimately not handled. In May 2025, when Cetus Protocol was hacked, $61 million in USDC completed a cross-chain transfer within 1.5 hours, but Circle added the address to the blacklist only a month later—by which time the funds had already been converted to ETH. In the October 2022 Mango Markets incident, $57.5 million flowed through Circle’s addresses, and ultimately was not frozen, even though the attacker was later charged by the U.S. Securities and Exchange Commission.
In addition, incidents such as the Nomad Bridge, the Ledger supply-chain attack, GMX, Remitano, and others were also named—indicating that Circle failed to respond promptly at multiple points in time. Notably, in some cases, competitor Tether had already frozen related USDT at the same time, but Circle did not take the same action.
Comparison with Tether: response speed is the key difference
In his investigation, ZachXBT specifically compared Circle’s response with that of other stablecoin issuers. He noted that in certain cases involving Lazarus Group, the other three issuers froze assets quickly, while Circle was late by as long as 4.5 months.
This gap not only affects the likelihood of recovering funds, but also further undermines the market’s trust foundation in USDC as a “compliant stablecoin.”
Market views hold that stablecoin issuers, while holding centralized control, also bear higher risk-management and regulatory responsibilities. If they fail to respond in time, it will directly amplify the overall systemic risk across the DeFi ecosystem.
ZachXBT: not opposing Circle, but demanding higher standards
Despite issuing harsh criticism, at the end ZachXBT stressed that he is not advocating targeting Circle or USDC. He said he still holds USDC and also acknowledges Circle’s performance at the product level.
However, he also pointed out that delays in compliance decisions have caused major losses to real users, and even led to hundreds of millions of dollars flowing out of the crypto ecosystem.
He raised a key question: “Who exactly is Circle serving?” and believes that as a company regulated by the United States, Circle has a duty to meet higher standards between technical capability and compliance enforcement.
The stablecoin responsibility boundary is under scrutiny again, and Circle has not responded
As of now, Circle has not issued an official response to the related accusations. However, this incident has already sparked extensive discussion in the community, covering risk-control mechanisms, regulatory pressure, and how centralized stablecoins are positioned within a decentralized ecosystem.
As stablecoins continue to become core infrastructure in the crypto market, the line over “whether they should proactively intervene” and “when to intervene” is becoming one of the most controversial issues in the industry.
This upheaval is not only about Circle itself; it may also affect the direction in which future regulators examine the overall stablecoin market.
This article: Circle accused of allowing $420 million in illegal funds to flow! ZachXBT reveals USDC compliance loopholes sparking controversy. First appeared on Chain News ABMedia.
