ZachXBT Report: Circle Cited for Compliance Failures in Over $420 Million Incidents

On April 3rd, on-chain investigator ZachXBT released a report detailing alleged compliance failures by Circle. The report claims that since 2022, the company has demonstrated “inadequate compliance enforcement” in multiple incidents involving illicit funds, with a cumulative amount exceeding $420 million. The report highlights that Circle, as the issuer of USDC, has consistently been known for its regulatory standing and robust compliance system. Its token contracts also possess the functionality to freeze and blacklist addresses, and its terms of service explicitly reserve the right to restrict suspicious accounts. However, in several significant security incidents, these mechanisms were not utilized promptly or effectively. The report specifically mentions the Drift Protocol attack on April 1st, 2026, where approximately $280 million in assets were stolen. The attacker transferred over $232 million USDC from Solana to Ethereum via Circle’s own cross-chain bridge, CCTP, within six hours, yet no assets were frozen during this period. Similar situations occurred in attacks on SwapNet, Cetus Protocol, and Mango Markets. In some cases, Circle failed to act promptly even after law enforcement and industry experts issued freezing requests, or only processed the assets after they had already been transferred. Furthermore, the report points out that Circle’s response in investigations involving money laundering by the Lazarus Group was significantly slower compared to other stablecoin issuers like Tether and Paxos. In some instances, freezing operations were delayed for months. Similar delays were observed in the Ledger supply chain attack and the GMX attack, where USDC remained in suspicious addresses for hours or even longer without being frozen. ZachXBT stated in the report that this disclosure is not intended to negate the value of Circle’s products or stablecoins themselves, but rather to emphasize that its compliance enforcement decisions have caused “real and significant losses” to the industry. He noted that over the past three years, due to repeated failures to act in a timely manner, the DeFi ecosystem has incurred losses in the nine figures, and the $420 million figure is a conservative estimate based on public cases, with the actual scale potentially being higher.