Circle’s $420M Compliance Crisis: ZachXBT Exposes Massive USDC Scandal

On-chain investigator ZachXBT has published a detailed investigation alleging delays or failures in USDC stablecoin issuer Circle to freeze theft proceeds worth over $420 million since 2022.

Dubbed the “Circle $USDC files,” the X thread highlights 15 cases in which the company took little to no action regarding illicit funds.

USDC issuer Circle faulted for $420M regulatory complacency

Among the highlighted cases is the most recent: the $285M Drift Protocol exploit, which has since caused a domino effect on 20 other Solana-based projects. ZachXBT noted a 6-hour delay in Circle’s action, during which the hacker laundered multiple batches of USDC.

In the same year, $3M (in USDC) of the $16M stolen from SwapNet sat in the hacker’s address for 2 days. Law enforcement and private entities requested a temporary freeze, which Circle did not honor.

In another major case, the North Korean cybercrime syndicate known as the Lazarus Group stole $1.5 billion in the February 2025 Bybit hack. While Tether froze the associated addresses within hours, Circle allegedly waited an additional 24 hours before acting.
Other reports detail thefts ranging from $200,000 to $223 million. Issuers delayed freezes for up to 4 months, while some never froze addresses associated with bad actors at all.

Source: X

One user noted the irony in Circle’s inaction, saying that blocking these addresses would have acted to their advantage.

Regulatory infringement in the crypto industry

Circle is the latest notable crypto player allegedly defying regulatory mandates related to illicit fund flows. Others are Binance and, even the Trump-associated World Liberty Financial, both being accused of Iran-linked flows.

The news brings into question Circle’s trustworthiness, especially considering that USDC is the second-largest stablecoin globally. The company had also reported building a compliance engine in 2024, but its use seems to have fallen through.