Circle Internet Financial, the publicly traded issuer of USDC (NYSE: CRCL), faces mounting scrutiny over what on-chain investigator ZachXBT has documented as $420 million in compliance failures since 2022. The controversy crystallized in the first week of April 2026 when Circle failed to freeze a...
"6 hours is how long Circle had to freeze stolen funds from the $280M+ Drift hack. Nothing was done." — ZachXBT, On-Chain Investigator
Circle Internet Financial, the publicly traded issuer of USDC (NYSE: CRCL), faces mounting scrutiny over what on-chain investigator ZachXBT has documented as $420 million in compliance failures since 2022. The controversy crystallized in the first week of April 2026 when Circle failed to freeze approximately $232 million in stolen USDC bridged through its own Cross-Chain Transfer Protocol (CCTP) during the $285 million Drift Protocol exploit — while just days earlier, on March 23, it had frozen 16 business wallets, including critical blockchain bridge infrastructure, under a sealed civil court order with no advance notice.
The juxtaposition exposes a structural tension at the center of the $77.5 billion USDC ecosystem: a regulated, publicly traded stablecoin issuer that can freeze any wallet at will, but whose compliance apparatus appears to operate asymmetrically — swift against court-ordered targets, slow against active theft. With USDC now capturing 64% of stablecoin transaction volume and Circle trading at $90.80 per share, the stakes of this compliance gap extend well beyond on-chain sleuthing.
On April 1, 2026, an attacker drained approximately $285 million from Solana-based Drift Protocol in roughly 12 minutes, according to TRM Labs. The exploit — which used fake token injection and compromised admin keys to manipulate oracles — resulted in approximately $71 million in USDC being extracted directly, per blockchain security firm PeckShield.
What followed was a six-hour window during which the attacker methodically consolidated stolen assets and bridged over $232 million in USDC from Solana to Ethereum via Circle's own CCTP infrastructure, executing more than 100 transactions. According to ZachXBT's analysis, Circle took no action to blacklist the receiving addresses during this period, despite the exploit being publicly known and widely reported on social media within minutes of its execution.
Circle's stated position: it freezes assets when legally required. The company has consistently maintained that acting without a court order or law enforcement directive could expose it to legal liability. According to CoinDesk, Circle emphasized the "growing tension for regulated issuers between acting quickly to curb illicit flows and avoiding overreach without court or law enforcement orders."
The Drift attack cascaded across the Solana ecosystem. According to CoinDesk, a dozen Solana protocols with exposure to Drift liquidity paused operations or assessed losses in the days following the exploit.
Nine days before it declined to freeze stolen Drift funds, Circle demonstrated its freezing capabilities with precision. On the evening of March 23, 2026, the company simultaneously blacklisted 16 wallet addresses in response to a sealed U.S. civil court order, according to AMLBot's analysis.
The freeze was executed with no advance notice to affected parties. Among the frozen addresses:
The partial reversal began on March 26, when Circle unfroze one wallet — Goated.com, which held 130,966 USDC, according to ZachXBT. As of early April, five of the 16 frozen wallets have reportedly been unfrozen, according to CCN. The civil case remains sealed, with no basis communicated to the remaining affected parties.
The contrast is stark. For a sealed civil case involving legitimate business wallets, Circle acted within hours. For the largest DeFi exploit of 2026, involving funds transiting Circle's own bridge infrastructure, it did not.
ZachXBT's investigation, published as the "Circle USDC files" on X, documents 15 cases since 2022 in which Circle allegedly took little or no action on illicit USDC flows totaling over $420 million. According to The Block, the cases include:
Drift Protocol (April 2026): $285 million exploit with a six-hour freeze window unused. The attacker laundered multiple batches of USDC during this period, per ZachXBT.
Cetus Protocol (May 2025): An exploiter used CCTP to bridge $61 million in USDC from Sui to Ethereum across more than 60 transactions over 1.5 hours, according to Cointelegraph. Both the Cetus team and private-sector investigators requested a freeze. Circle blacklisted the address one month later — after the USDC had already been converted to ETH.
LIBRA Memecoin Scam (May 2025): Circle froze approximately $57 million in USDC tied to a civil case, according to historical reporting.
Bybit Hack (February 2025): The Lazarus Group-attributed $1.5 billion theft included USDC flows that ZachXBT flagged as inadequately addressed.
SwapNet Hack: $3 million in stolen USDC sat in the hacker's address for two days. Law enforcement and private entities requested a temporary freeze, which Circle did not honor, according to ZachXBT's documentation.
ZachXBT noted in his thread, as reported by Crypto Briefing: "Circle builds good products, and I hold USDC myself." The criticism, he stated, is directed at the compliance process, not the product.
The contrast with Tether's approach quantifies the gap. According to AMLBot's data analysis covering 2023-2025:
| Metric | Tether (USDT) | Circle (USDC) | |--------|--------------|---------------| | Blacklisted addresses | 7,268 | 372 | | Total value frozen | $3.29 billion | $109 million | | Ratio (addresses) | 30x more | Baseline | | Ratio (value) | 30x more | Baseline |
The enforcement philosophies diverge fundamentally. According to AMLBot:
The scale difference — 30x in both address count and dollar value — partially reflects USDT's larger market presence ($176 billion market cap vs. USDC's $77.5 billion, per CoinMarketCap). But adjusting for market cap, Tether's freeze rate per dollar of stablecoin in circulation still exceeds Circle's by a significant margin.
In January 2026, Tether froze $182 million in USDT on Tron in a single enforcement action, according to CryptoTimes. Circle has no comparable single-action precedent at that scale for illicit fund recovery.
The compliance controversy arrives at a regulatory inflection point for stablecoins.
The GENIUS Act, enacted July 18, 2025, established a federal framework for payment stablecoins. The OCC published a 376-page proposed rule on March 2, 2026, implementing the Act's requirements. According to the OCC's Bulletin 2026-3, the rule mandates 1:1 reserve backing with eligible assets including U.S. cash, insured bank deposits, and short-term Treasury notes. The comment period closes May 1, 2026.
The CLARITY Act market structure bill, currently stalled in the Senate Banking Committee, includes stablecoin yield provisions being negotiated by Senators Thom Tillis (R-NC) and Angela Alsobrooks (D-MD). According to CoinDesk, the revised yield compromise text — which bans yield based solely on passive stablecoin balances but allows activity-based rewards — was expected this week but has been delayed. A markup hearing is expected in the second half of April.
Neither bill explicitly addresses the freeze-response timeline question that the Drift controversy raises. The GENIUS Act's OCC framework focuses on reserve adequacy and capital requirements, not on the speed or criteria by which an issuer should freeze funds during an active exploit. According to Nixon Peabody's analysis of the proposed rule, the OCC's supervisory requirements focus on risk management broadly but do not prescribe incident-response freeze timelines.
This represents a regulatory gap. As stablecoins become embedded in DeFi infrastructure — USDC is integrated across hundreds of protocols and serves as a base asset on multiple chains — the issuer's freeze decisions carry systemic implications. A freeze that is too slow allows theft to propagate; a freeze that is too fast or broad disrupts legitimate commerce, as the March 23 incident demonstrated.
Circle trades at $90.80 per share as of April 2, 2026, down from recent highs. The stock fell 4.95% on April 1, the day of the Drift exploit, according to market data reported by Simply Wall St.
The company IPO'd at $31 per share in June 2025, reaching a valuation of approximately $6.9 billion, according to Ledger Insights. The current market cap implies significant appreciation from the listing price, but the compliance controversy introduces a new category of risk for public-market investors evaluating stablecoin issuers.
USDC's market position shows mixed signals. At $77.5 billion in market cap, it commands 25% of the stablecoin market versus USDT's 58%, according to CoinMarketCap. However, USDC has captured 64% of stablecoin transaction volume, surpassing USDT in flow activity for the first time, according to Phemex. USDC's Ethereum market cap alone hit a record $55 billion in March 2026, per Hokanews.
This transaction volume dominance makes the compliance question more acute. Higher transaction throughput means more potential illicit flow touchpoints, and the expectation of faster response grows proportionally.
For DeFi protocols, the episode reinforces a known risk: any protocol holding significant USDC balances carries counterparty exposure to Circle's freeze decisions — both the risk of action (legitimate wallets frozen under sealed orders) and inaction (stolen funds not frozen during active exploits). This dual exposure is not easily hedged.
The data presents a stablecoin issuer caught between two imperatives. As a regulated, publicly traded company, Circle maintains that it can only freeze funds pursuant to legal orders — a position with clear legal logic. As the issuer of a $77.5 billion token embedded across hundreds of DeFi protocols and multiple chains, its inaction during active exploits allows stolen funds to be laundered through its own infrastructure.
The 30x enforcement gap with Tether is not merely a statistical curiosity. It reflects a fundamental design choice: Tether opts for proactive, broad-scale enforcement at the cost of centralization concerns; Circle opts for legal formalism at the cost of responsiveness. Neither approach has been stress-tested by regulators.
The OCC's 376-page GENIUS Act rulemaking, open for comment through May 1, addresses reserve quality and capital adequacy. It does not address the freeze-response question. Until regulators define what "compliance" means in the context of real-time exploit response, the $320 billion stablecoin market operates with a structural gap between the power to freeze and the willingness to use it.