ZachXBT Accuses Circle of Compliance Failures Over $420 Million in Illicit Funds

Blockchain investigator ZachXBT publicly accused stablecoin issuer Circle of failing to freeze over $420 million in illicit USDC funds across more than 15 cases since 2022, with the most recent incident involving the Drift Protocol exploit where attackers bridged $232 million in stolen USDC from Solana to Ethereum through Circle's CCTP without intervention. Circle defends its approach as legally compliant, stating it only freezes assets when required by law enforcement or court orders to protect user rights, while legal experts note that acting without formal authorization could expose the company to liability. The controversy highlights a fundamental tension in crypto: moving too slowly risks enabling bad actors, while acting too quickly raises concerns about overreach, with critics arguing USDC cannot claim to be neutral infrastructure while maintaining discretionary freezing powers.

Circle's Response and Inaction During the Drift Hack

• ▪The Drift hack resulted in $285 million in stolen funds
• ▪The Drift hack attacker used Circle's cross-chain transfer protocol CCTP to bridge about $232 million in USDC from Solana to Ethereum
• ▪The Drift hack attacker siphoned off roughly $71 million in USDC as part of the exploit on Wednesday

Legal and Regulatory Constraints on Freezing Assets

• ▪Salman Banei argued lawmakers should provide a safe harbor from civil liability if digital asset issuers freeze assets when there is strong basis to believe illicit transfers have occurred
• ▪Salman Banei is general counsel of tokenized asset network Plume
• ▪Salman Banei said freezing assets without formal authorization could expose issuers to liability if done incorrectly

Broader Tensions Between Compliance and Rapid Response

• ▪Ben Levit is founder and CEO of stablecoin ratings agency Bluechip
• ▪Ben Levit said the Drift exploit was more of a market or oracle exploit rather than a clean hack, putting it in a gray zone
• ▪Ben Levit said any action by Circle in the Drift exploit becomes a judgment call, not just a compliance decision
• ▪Roughly $141 billion in stablecoin transactions in 2025 were linked to illicit activity including sanctions evasion and money laundering according to TRM Labs

Perspective of ZachXBT

• ▪ZachXBT accused Circle of failing to freeze over $420 million in illicit USDC funds across more than 15 cases since 2022
• ▪ZachXBT believes Circle could have prevented $232 million in stolen USDC from being bridged through CCTP during the Drift Protocol exploit