Circle has faced new scrutiny after Onchain investigator ZachXBT alleged that the USDC issuer failed to freeze or blacklist about $420 million in illicit money flows since 2022.
summary
- Circle has failed to freeze illicit USDC across 15 hack and fraud cases since 2022, ZachXBT said.
- The claims included GMX, Cetus and Drift, where Circle allegedly had time to block the funds.
- The accusations have renewed debate over stablecoin issuers, compliance duties, and delayed responses to chain crimes.
The claims centered on 15 hack and fraud cases that Circle allegedly had time to act on but did not move quickly enough, according to a public ZachXBT thread and follow-up reports.
ZackXBT He said Circle took “minimal” action or failed to act in 15 separate cases related to stolen or illicit USDC flows. He said the delay spanned over three years and included law enforcement requests, private sector requests, and cases that were visible on-chain.
He pointed to several examples. ZachXBT said Circle did not freeze about $9 million worth of USDC linked to the GMX hack in July 2025. He also said that Circle’s blacklisted wallets were linked to the Cetus hack only after the stolen USDC had already been converted to Ether.
Recently Drift protocol statusHe said the attackers moved about $232 million over a six-hour period through more than 100 transactions before transferring the money. Cointelegraph said Circle did not provide an immediate response before publication.
These allegations have renewed debate about how much liability a central stablecoin issuer should bear during cases of hacks and fraud. Circle has the technical ability to freeze USDC addresses and blacklist wallets, which has made the timing of any response a central issue in the discussion around ZachXBT’s claims.
ZachXBT tried to separate the criticism from the broader attack on Circle. books,
“Circle makes good products, and I manage the USDC myself. This is not a post about hoping it collapses.”
He added that “nine figures have been lost from the ecosystem due to repeated inaction,” and said the $420 million only covers major public issues.
The department’s past actions remain in focus
The renewed criticism also drew attention to Circle’s previous comments on transaction controls. In September 2025, Circle CEO Heath Tarbert said the company was exploring “reversible” USDC transactions that could be undone or modified in cases of hacking, theft or fraud. This idea suggests that Circle was already considering stronger user protections for some payment flows.
Circle has acted in other enforcement cases before. In August 2022, the US Treasury Department’s Office of Foreign Assets Control imposed sanctions Tornado CashSaying that the mixer was used to launder more than $7 billion in virtual currencies since 2019. Following those sanctions, Circle froze USDC associated with sanctioned Tornado Cash addresses, showing that the company used blacklisting controls when compliance measures required it.
