TL;DR
- On-chain investigator ZachXBT published the report “The Circle USDC Files” on the X platform on April 3, 2026
- The report claims Circle failed to freeze or blacklist approximately $420 million in USDC linked to 15 hacks and scam cases since 2022
- Among the most serious individual cases is the Drift Protocol attack, where the attacker allegedly moved $232 million in USDC without Circle intervening for six hours
- Circle responds that the company complies with legal orders and freezes funds where required by law
ZachXBT Levels Strong Criticism Against Circle
The pseudonymous on-chain investigator ZachXBT, known for uncovering crypto fraud and hacker operations, released a comprehensive analysis he titled “The Circle USDC Files” on Thursday, April 3. The report, published on X, directs serious criticism at Circle — the company behind the stablecoin USDC — claiming that over a four-year period, the company repeatedly failed to use its technical capabilities to halt illicit money flows.
According to ZachXBT's review, this involves over $420 million distributed across 15 documented hacks and scam incidents. The investigator emphasizes that the analysis only covers known, publicly reported cases, and suggests that the actual scope could be significantly higher.
ZachXBT emphasizes that Circle possesses the technical capacity to freeze USDC and blacklist wallets — which makes the alleged delays a serious compliance issue.
The Most Serious Individual Cases
Drift Protocol: Six Hours Without Response
Among the most egregious episodes highlighted by ZachXBT is the attack on Drift Protocol. The report claims that Circle waited six hours after the attack became known, and in the meantime, the attacker allegedly moved $232 million in USDC from Solana to Ethereum via Circle's own Cross-Chain Transfer Protocol (CCTP) — spread across more than a hundred transactions. The total attack amounted to $280 million.
Cetus and GMX: Too Late
In connection with the hack against Cetus DEX in May 2025, involving a total of $200 million, Circle reportedly blacklisted relevant wallets — but only after the USDC had already been converted to Ether (ETH), and thus beyond Circle's reach. In the GMX hack in July 2025, ZachXBT claims that approximately $9 million in USDC was never frozen.
Other Cases in the Report
The Comparison with Tether
A recurring theme in ZachXBT's analysis is the comparison with competitor Tether, the issuer of USDT. The report claims that Tether often acts faster in similar situations — sometimes within hours — while Circle, according to ZachXBT, either reacts slowly or fails to act. This is an assertion that, if true, would cast Circle's compliance procedures in a critical light, especially given the increased regulatory focus on stablecoins globally.
Circle's Response: Complies with the Law
According to available source material (Bitcoinist), Circle has responded that the company “complies with legal orders and freezes funds when required by law.” The company did not provide a detailed refutation of ZachXBT's individual claims immediately after publication, which currently makes the debate one-sided.
It is worth noting that ZachXBT's report is published on social media and has not been peer-reviewed. The claims are serious but should be read with this caveat. Circle has not confirmed the specific figures in the report.
Regulatory Backdrop
The case comes at a time when stablecoin regulation is high on the agenda in several jurisdictions, including the EU with the MiCA framework and ongoing discussions in the USA about a dedicated stablecoin law. The question of how quickly and consistently stablecoin issuers are obligated to act in cases of documented crime is one of the core points in these debates.
If ZachXBT's findings prove to be accurate, they could put pressure on regulators to introduce clearer and stricter requirements for freezing funds and cooperation with law enforcement for centralized stablecoin issuers.
