Circle Internet Financial, the issuer of the $77.2 billion USDC stablecoin, faces a mounting compliance credibility crisis following a detailed investigation by on-chain researcher ZachXBT documenting 15 cases since 2022 in which the company failed to freeze or delayed freezing a cumulative $420 ...
"Why should crypto businesses continue to build on Circle when a project with nine-figure TVL could not get support during a major incident?" — ZachXBT, On-Chain Investigator
Circle Internet Financial, the issuer of the $77.2 billion USDC stablecoin, faces a mounting compliance credibility crisis following a detailed investigation by on-chain researcher ZachXBT documenting 15 cases since 2022 in which the company failed to freeze or delayed freezing a cumulative $420 million in allegedly stolen USDC. The report, published April 3-4, 2026, landed days after the $285 million Drift Protocol exploit — the largest DeFi hack of 2026 — in which attackers bridged 232 million USDC through Circle's own Cross-Chain Transfer Protocol (CCTP) over six hours during U.S. business hours without a single freeze action.
The contrast with Circle's own enforcement record sharpens the critique. On March 23, 2026 — nine days before the Drift exploit — Circle blacklisted 16 operational business wallets in a sealed U.S. civil case, sweeping crypto exchanges, casinos, forex brokers, and the DFINITY Foundation's ckETH Minter smart contract. At least five of those wallets were subsequently unfrozen. The pattern ZachXBT identifies is blunt: aggressive on civil process, passive on theft.
For a publicly traded company (NYSE: CRCL, market cap ~$22.3 billion as of April 3, 2026) that derives 95.5% of its revenue from interest on Treasury reserves backing USDC, the compliance gap carries material risk — particularly as the GENIUS Act's implementing regulations from the OCC, due for comment by May 1, 2026, will explicitly mandate technical capabilities to "block, freeze, and reject" impermissible transactions.
ZachXBT's investigation, titled "The Circle USDC Files," catalogues 15 discrete incidents since 2022 in which Circle either delayed action or took no freeze action on USDC tied to exploits, hacks, and sanctioned entities. The researcher noted the $420 million total is likely conservative, stating the true figure could be "substantially higher."
The documented cases span the full range of DeFi security failures:
| Incident | Date | Amount at Risk | Circle Action | |---|---|---|---| | Drift Protocol exploit | Apr 1, 2026 | $232M USDC bridged | No freeze | | SwapNet exploit | Jan 25, 2026 | $3M USDC accessible 2 days | Freeze denied | | Cetus Protocol hack | May 22, 2025 | $61M USDC bridged in 90 min | Blacklisted 1 month later | | GMX exchange breach | Jul 2025 | $9M USDC | Not frozen | | Mango Markets exploit | Oct 2022 | $57.5M routed via Circle deposit | Never frozen on-chain | | Nomad Bridge hack | Aug 2022 | $45M USDC freezable for 30-45 min | No action | | Garantex (sanctioned) | Ongoing | 200K+ USDC | Untouched |
In several cases, the funds were converted or moved before any court order could be obtained — a timeline gap that critics argue Circle's contractual authority was designed to fill. USDC's smart contract includes blocklist functionality that allows Circle to freeze addresses "in its sole discretion," according to its terms of service.
The April 1, 2026 Drift Protocol exploit serves as the most damaging case study. At approximately 11:06 a.m. ET, attackers — later linked to North Korean state actors by blockchain analytics firm Elliptic — exploited a vulnerability involving durable nonces to seize control of Drift's Security Council administrative powers.
The timeline:
Drift's total value locked collapsed from $550 million to $247 million — a 55% drop. The DRIFT token fell 37% on the day of the hack and trades at approximately $0.043, down 98% from its November 2024 all-time high of $2.65.
The attack occurred during U.S. business hours. Circle's compliance team had access to the same public blockchain data flagged by multiple independent researchers within the first hour. ZachXBT characterized the response: "Circle was asleep while many millions of USDC was swapped via CCTP from Solana to Ethereum for hours."
The attacker subsequently converted approximately $33 million of the stolen funds to ETH on the Ethereum side, further reducing recovery prospects.
The juxtaposition of Circle's enforcement posture between civil and criminal matters forms the structural core of ZachXBT's argument.
On March 23, 2026 — nine days before the Drift exploit — Circle executed a mass blacklist action against 16 wallet addresses simultaneously. The action was tied to U.S. civil case 26-cv-2327, a sealed proceeding in New York. The frozen wallets belonged to operating businesses: crypto exchanges, online casinos, forex brokers, and payment processors.
One frozen wallet belonged to DFINITY Foundation's ckETH Minter contract, a smart contract bridging the Internet Computer Protocol to Ethereum. Another belonged to Goated.com, holding approximately $131,000 in USDC. At least five of the 16 wallets were later unfrozen, suggesting the initial action was overbroad.
ZachXBT described the March 23 action as "potentially the single most incompetent freeze" he had witnessed in over five years of on-chain investigations.
The pattern: Circle moved swiftly and broadly on a sealed civil court order affecting legitimate businesses, then took zero action during a six-hour window in which $232 million in stolen funds transited its own bridge.
The data gap between Circle and its primary competitor Tether is stark.
| Metric | Tether (USDT) | Circle (USDC) | |---|---|---| | Total frozen (cumulative) | $3.3 billion | ~$110 million | | Blacklisted addresses | 7,268+ | ~596 | | Funds frozen in 2025 alone | $1.26 billion | Not disclosed | | Active investigations assisted | 1,800+ across 62 countries | Not disclosed |
Specific comparative incidents highlight the response-time differential:
In January 2026, Tether froze $182 million in IRGC-linked wallets in a single day across five Tron addresses. In March, it blocked an additional $6.76 million from IRGC and Houthi-linked wallets. These actions occurred without the delays characteristic of Circle's documented response pattern.
The ratio speaks for itself. Tether, often criticized for opacity in reserve attestations, has frozen roughly 30 times more value than Circle — the company that has built its brand on regulatory compliance and institutional trust.
Circle's position, articulated through a company spokesperson, is that it "freeze[s] assets when legally required, consistent with the rule of law and with strong protections for user rights and privacy."
Legal experts have offered partial support. Salman Banei, general counsel at Plume, emphasized that freezing without legal authorization exposes issuers to significant legal liability. Ben Levit, CEO of Bluechip, characterized the Drift incident as involving market and oracle manipulation, placing it in "murky legal territory" where the distinction between exploitation and theft is not legally settled.
The argument has structural coherence: a regulated financial entity acting without court orders risks civil liability from wrongful freezes. Circle points to the March 23 incident — where it froze wallets per court order and later had to reverse five — as evidence of the risks of aggressive action.
The counterargument is equally structural: USDC's smart contract gives Circle unilateral authority to blacklist addresses at its sole discretion. This authority exists precisely for situations where six-hour windows determine whether $232 million is recoverable or lost. The question is not whether Circle has the legal right to freeze — its own contract confirms it does — but whether its compliance apparatus is operationally capable of exercising that right in real time.
The GENIUS Act, signed into law and now in the implementing-rulemaking phase, mandates that permitted stablecoin issuers maintain "technical capabilities, policies, and procedures to block, freeze, and reject specific or impermissible transactions that violate Federal or State laws" in both primary and secondary markets.
The OCC issued its proposed rulemaking on March 2, 2026, covering licensing, reserves, and operational standards. The comment deadline is May 1, 2026, with full enforcement expected between mid-2026 and 2027. Penalties include civil fines, criminal prosecution, and license revocation.
The ZachXBT dossier effectively provides regulators with a pre-packaged case study of what inadequate freeze capabilities look like in practice. If Circle cannot demonstrate that its compliance infrastructure can act within minutes — not hours or months — during active exploits, it faces regulatory risk under the very framework it lobbied to create.
CRCL shares traded at $90.26 on April 3, 2026, down from a 52-week high of $298.99 — a 70% decline. The stock's 52-week low of $49.90 in early 2026 preceded a partial recovery, but the compliance controversy adds a new risk vector for institutional holders evaluating a company that generates 95.5% of revenue from interest on USDC reserves.
USDC's market position remains significant: $77.2 billion in circulation, 24.5% of the $316.8 billion stablecoin market. However, the compliance gap creates a credibility asymmetry. Circle's value proposition to institutional adopters rests on being the regulated, compliant alternative to Tether. If Tether demonstrably outperforms Circle on enforcement by a 30:1 ratio, that narrative erodes.
ZachXBT posed the question directly: why should crypto businesses build on USDC when a protocol with nine-figure TVL could not get compliance support during an active exploit?
The data presents a clear pattern. Circle possesses the contractual authority and technical infrastructure to freeze USDC in real time. Its smart contracts include blocklist functionality exercisable at its sole discretion. Its CCTP bridge processes every cross-chain USDC transfer. Yet across 15 documented cases totaling $420 million, the company either did not act or acted too late.
The defense that Circle freezes only when "legally required" is undercut by the March 23 mass freeze of 16 business wallets — including a blockchain bridge smart contract — in a civil proceeding. The company clearly can and does act aggressively when presented with court orders in civil matters. The gap is in real-time response to active theft.
With the GENIUS Act's implementing regulations entering their comment period and enforcement mechanisms including license revocation, Circle's compliance infrastructure faces its first test as a regulated entity under a purpose-built stablecoin framework. The $420 million dossier provides regulators, counterparties, and institutional holders with a detailed record of what that infrastructure has — and has not — delivered.