ZachXBT: Circle has repeatedly failed in compliance actions, involving an amount exceeding 420 million dollars

On-chain detective ZachXBT released an investigative report on Circle, stating that since 2022, the company has faced issues of "poor compliance enforcement" in multiple incidents involving illegal funds, with a total amount exceeding $420 million.

The report points out that Circle, as the issuer of USDC, has always been known for its regulated and well-compliant system. Its token contracts also have the functionality to freeze and blacklist addresses, and it explicitly reserves the right to restrict suspicious accounts in its terms of service. However, these mechanisms were not used timely and effectively during several major security incidents.

The report highlights the attack on Drift Protocol on April 1, 2026, where approximately $280 million in assets were stolen. The attacker used Circle's own cross-chain bridge CCTP to transfer over $232 million USDC from Solana to Ethereum within 6 hours, but no assets were frozen during this period. Similar situations occurred in attacks on SwapNet, Cetus Protocol, and Mango Markets, where in some cases, even after law enforcement and industry experts issued freeze requests, Circle still did not take timely action, and even processed the situation only after the assets had been transferred.

Additionally, the report noted that in the money laundering investigation involving the hacker group Lazarus Group, Circle's response was significantly slower compared to other stablecoin issuers (such as Tether, Paxos, etc.). In some cases, freeze operations were delayed for several months. Similar delays were also seen in the Ledger supply chain attack and the GMX attack, where USDC remained in suspicious addresses for several hours or even longer without being frozen.

ZachXBT stated in the report that this disclosure does not negate the value of Circle's products or the stablecoin itself, but emphasizes that its compliance enforcement decisions have caused "real and significant losses" to the industry.

He pointed out that over the past three years, due to multiple failures to act in a timely manner, the DeFi ecosystem has accumulated losses reaching nine figures, and the $420 million is only a conservative estimate of publicly known cases, with the actual scale potentially being higher.