ZachXBT Investigation Report: Circle Fails Compliance Multiple Times, Involved Amount Exceeds $420 Million

On-chain detective ZachXBT released an investigation report on Circle on April 3, 2026, alleging the firm has demonstrated lax compliance enforcement in multiple illicit fund incidents since 2022, with total illicit funds exceeding $4.2 billion. Circle, issuer of stablecoin USDC, has long been recognized for regulatory compliance and a robust compliance framework. Its token contract includes address freeze and blacklisting capabilities, and its terms of service explicitly reserve the right to restrict suspicious accounts. However, these mechanisms were not deployed timely or effectively in several major security breaches. The report specifically cites the April 1, 2026 Drift Protocol attack, where attackers stole approximately $2.8 billion in assets. Using Circle’s proprietary cross-chain bridge CCTP, the attacker transferred over 2.32 billion USDC from Solana to Ethereum within 6 hours—no assets were frozen during this window. Similar issues emerged in attacks on SwapNet, Cetus Protocol, and Mango Markets: in some cases, Circle failed to act promptly even after law enforcement and industry experts issued freeze requests, only addressing the situation after assets had been transferred. Additionally, the report notes Circle’s response was significantly delayed compared to peers like Tether and Paxos in money laundering investigations involving the Lazarus Group hacker collective. In some instances, freeze operations were delayed by months. Similar delays occurred in the Ledger supply chain attack and GMX attack, where USDC remained in suspicious addresses for hours or longer without being frozen. ZachXBT stated the disclosure does not negate Circle’s product value or USDC itself, but emphasizes the firm’s compliance enforcement decisions have caused “real and significant losses” to the industry. He noted that over the past three years, delayed action across multiple incidents has led to nine-figure losses in the DeFi ecosystem—with the $4.2 billion figure being a conservative estimate based on public cases, and the actual amount potentially higher.