{"id":70648,"date":"2026-04-04T18:01:07","date_gmt":"2026-04-04T18:01:07","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/zachxbt-says-circle-froze-16-legitimate-wallets-missed-real-hacks-crypto-news-bitcoin-news\/"},"modified":"2026-04-04T18:01:07","modified_gmt":"2026-04-04T18:01:07","slug":"zachxbt-says-circle-froze-16-legitimate-wallets-missed-real-hacks-crypto-news-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/zachxbt-says-circle-froze-16-legitimate-wallets-missed-real-hacks-crypto-news-bitcoin-news\/","title":{"rendered":"ZachXBT Says Circle Froze 16 Legitimate Wallets, Missed Real Hacks \u2013 Crypto News Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<p><strong>Key Takeaways:<\/strong><\/p>\n<ul>\n<li>Onchain investigator ZachXBT identified 15 cases totaling over $420M in illicit USDC flows Circle failed to freeze promptly since 2022.<\/li>\n<li>The Drift Protocol exploit saw 232M USDC bridged via Circle\u2019s own CCTP over 6 hours with no freeze during U.S. business hours.<\/li>\n<li>Circle froze 16 legitimate business wallets in a March 2026 civil case, including DFINITY Foundation\u2019s ckETH Minter contract, with 5 later unfrozen.<\/li>\n<\/ul>\n<h2>Did Circle Fail to Freeze Stolen USDC? ZachXBT Says Yes, With Receipts<\/h2>\n<p>The thread, titled \u201c<a href=\"https:\/\/x.com\/zachxbt\/status\/2040055757211885953?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">Welcome to the Circle USDC files<\/a>,\u201d was posted to X and laid out specific hacks, frauds, and North Korea-linked theft cases where <a href=\"https:\/\/news.bitcoin.com\/circle-reveals-wrapped-bitcoin-product-with-real-time-onchain-reserve-verification\/\">Circle<\/a> held the technical ability and contractual authority to freeze or blacklist USDC wallets but did not act promptly, or at all. ZachXBT cited onchain addresses, transaction timelines, and communications involving law enforcement, victims, and private-sector security firms.<\/p>\n<p>Among the cases, ZachXBT flagged the April 1, 2026, Drift Protocol exploit, attributed to North Korea\u2019s Lazarus Group by <span>blockchain<\/span> analytics firm Elliptic, as a standout example. Attackers bridged more than 232 million <a href=\"https:\/\/news.bitcoin.com\/circle-deploys-usdc-and-cctp-on-pharos-network-to-advance-realfi-goals\/\">USDC<\/a> from <span>Solana<\/span> to Ethereum using Circle\u2019s own Cross-Chain Transfer Protocol in over 100 transactions across six hours during U.S. business hours. Circle made no freeze.<\/p>\n<p>ZachXBT\u2019s post highlights the Swapnet exploit from January 25, 2026, which saw $16 million stolen, with 3 million USDC sitting accessible for two days while law enforcement and private investigators submitted temporary freeze requests that Circle denied. The funds were swapped before a court order could be obtained.<\/p>\n<p>In the Cetus Protocol hack from May 22, 2025, attackers took $223 million and bridged 61 million USDC via Circle\u2019s infrastructure over 90 minutes. Circle blacklisted the funds one month later, after they had already been converted to Ether.<\/p>\n<p>ZachXBT also pointed to the <a href=\"https:\/\/news.bitcoin.com\/mango-markets-future-hangs-in-the-balance-with-new-sec-settlement-vote\/\">Mango Markets<\/a> exploit from October 2022, where $57.5 million was routed through a Circle deposit address and never frozen onchain. The exploiter was later charged by the U.S. Securities and Exchange Commission (SEC). In the Nomad Bridge hack from August 2022, approximately $45 million USDC sat freezable for 30 to 45 minutes following a $190 million breach. He says Circle did not act.<\/p>\n<p>The investigator noted Circle took 4.5 months longer than Tether, Paxos, and other <span>stablecoin<\/span> issuers to freeze Lazarus Group-linked addresses flagged in an April 2024 report. He also documented delayed responses involving <a href=\"https:\/\/news.bitcoin.com\/elliptic-uncloaks-60b-in-illicit-garantex-transactions-aiding-us-takedown\/\">Garantex<\/a>, the sanctioned Russian exchange, where over 200,000 USDC went untouched while Tether froze $22 million in a parallel action.<\/p>\n<p>Circle\u2019s official position, delivered through spokesperson statements to the media, holds that the company freezes assets only when legally required, including in response to sanctions designations, law enforcement orders, or court mandates. The company says preemptive freezes without legal authorization expose <a href=\"https:\/\/news.bitcoin.com\/circle-reveals-wrapped-bitcoin-product-with-real-time-onchain-reserve-verification\/\">Circle<\/a> to liability and infringe on user rights. Its terms of service permit discretionary action, but the company\u2019s practice prioritizes formal legal process.<\/p>\n<p><a href=\"https:\/\/news.bitcoin.com\/kraken-user-loses-18-2m-in-crypto-social-engineering-attack-as-funds-move-via-thorchain-zachxbt\/\">ZachXBT<\/a> acknowledged Circle builds quality products and said he personally holds USDC. His criticism centers on whether Circle\u2019s compliance priorities match the losses the broader <a href=\"http:\/\/www.bitcoin.com\/get-started\/a-quick-introduction-to-crypto\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">crypto<\/a> ecosystem absorbs when freezes are delayed or withheld.<\/p>\n<h2>Legitimate Operations Frozen<\/h2>\n<p>A separate incident amplified the criticism. On or around March 23, 2026, Circle froze USDC balances in 16 unrelated business wallets tied to a sealed U.S. civil case in New York, identified as approximately case 26-cv-2327. The wallets belonged to <a href=\"http:\/\/www.bitcoin.com\/get-started\/a-quick-introduction-to-crypto\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">crypto<\/a> exchanges, online casinos, forex brokers, payment processors, and the ckETH Minter <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-a-smart-contract\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">smart contract<\/a> operated by the DFINITY Foundation, which bridges the Internet Computer Protocol to Ethereum.<\/p>\n<p>ZachXBT called it potentially the single most incompetent freeze he had witnessed in more than five years of investigations. He said basic onchain analysis would have shown the wallets were active operational infrastructure with no apparent connections to each other or to the underlying civil matter.<\/p>\n<p>At least five of the 16 wallets were later unfrozen, including DFINITY\u2019s contract and Goated.com\u2019s wallet holding roughly $131,000 USDC. More reversals were expected as of the time of reporting. Circle issued no detailed public rebuttal to the full thread as of April 4, 2026.<\/p>\n<p>The cases collectively raise direct questions about how a U.S.-regulated <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-are-stablecoins\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">stablecoin<\/a> issuer headquartered in <a href=\"https:\/\/news.bitcoin.com\/two-crypto-court-twists-in-new-york-sec-walks-away-from-bitclout-deso-case-judge-rejects-eminifx-rico-claims\/\">New York<\/a> weighs legal caution against real-world losses from illicit activity its infrastructure helps move.<\/p>\n<\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/usdc-freeze-controversy-zachxbt-says-circle-froze-16-legitimate-wallets-missed-real-hacks\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways: Onchain investigator ZachXBT identified 15 cases totaling over $420M in illicit USDC flows Circle failed to freeze promptly since 2022. The Drift Protocol exploit saw 232M USDC bridged via Circle\u2019s own CCTP over 6 hours with no freeze during U.S. business hours. Circle froze 16 legitimate [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":70649,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/70648"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=70648"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/70648\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/70649"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=70648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=70648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=70648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}