ZachXBT Alleges a $420 Million Compliance Failure at Circle Since 2022

Pseudonymous Onchain investigator ZachXBT has accused stablecoin issuer Circle of compliance failures. In a thread on X (formerly Twitter), ZachXBT listed 15 cases where Circle delayed freezing stolen USDC.

According to him, this enabled bad actors to successfully move over $420 million in funds that could have been frozen if Circle had acted fast.

ZachXBT Says Circle Too Slow with Freezing Illicit Funds

The post from the onchain investigator appears to have been triggered by the recent Drift Protocol hack. The Solana-based decentralized exchange was recently exploited, with over $280 million stolen in an incident linked to North Korea hacker groups.

However, ZachXBT believes some of the stolen funds could have been frozen if Circle had acted. According to him, the hackers used Circle CCTP to bridge 232 million USDC from Solana to Ethereum. This took more than six hours across 100+ transactions.

He wrote:

“Despite the attacker laundering funds over six consecutive hours across Circle’s own native bridge, no USDC was frozen.”

The onchain sleuth highlighted 14 other incidents in which the exploiter used USDC to launder funds. These include the Cetus Protocol exploit last year, where $223 milion was stolen, and the $110 milion hack of Mango Markets in 2022.

In these three cases and others, ZachXBT showed a pattern of Circle failing to freeze funds and blacklist wallets in a timely manner, even when requested by law enforcement.

A report in 2024 highlighted this, noting that when law enforcement submitted freeze requests to  Circle, Tether, Paxos, and Techteryx for two addresses in relation to the report. The others acted prompted while it took 4.5 months longer before it froze the addresses.

ZachXBT Wants Circle to do Better

Meanwhile, the pseudonymous investigator noted that criticisms of Circle stem from his desire to see the stablecoin issuer fail. He acknowledged that the company has good products, and he also holds USDC.

However, he is calling for a change in its compliance process due to the negative impacts on the ecosystem. He noted that Circle is registered and licensed in the US, and that the company has the resources to do better, given the real-life consequences of its decisions.

He wrote:

“Nine figures lost from the ecosystem because of repeated inaction across three years, law enforcement requests, private sector requests, and their own infrastructure. The $420M+ figure only accounts for major public cases. The real figure is likely significantly higher.”

So far, the report has triggered multiple comments from the crypto community, especially in light of the Drift Protocol exploit. For many, it raises questions about Circle positioning its USDC as a more regulatory-compliant stablecoin.

Still, it is unlikely to have any major impact on the USDC position as the second biggest stablecoin. USDC currently has a circulating supply of $77 billion. Circle stock CRCL remains up year-to-date despite a recent decline.