Drift

ZachXBT

Cetus Protocol

when

USDC

<h2 id="tldr">TLDR</h2>
<ul>
 <li>Blockchain investigator ZachXBT accused Circle of delaying USDC freezes tied to more than $420 million in alleged illicit funds.</li>
 <li>He detailed 15 cases and claimed Circle failed to act quickly during major crypto exploits.</li>
 <li>The Drift Protocol exploit involved over $280 million and included $232 million in bridged USDC.</li>
 <li>ZachXBT said the attacker moved funds across Circle’s bridge for six hours without a freeze.</li>
 <li>He also cited the $223 million Cetus Protocol exploit and said Circle blacklisted an address one month later.</li>
</ul>
<p>Blockchain investigator ZachXBT has accused Circle of failing to freeze <a href="https://blockonomi.com/ramp-stablecoin-accounts-beta-brings-usdc-treasury-tools-to-50000-businesses/" rel="noopener noreferrer nofollow">USDC</a> tied to alleged illicit activity exceeding $420 million. He detailed 15 cases in a public thread on X and questioned the company’s response speed. Circle responded that it complies with legal orders and freezes assets when required by law.</p>
<h2 id="circle-faces-scrutiny-over-usdc-compliance-response">Circle Faces Scrutiny Over USDC Compliance Response</h2>
<p>ZachXBT said several <a href="https://x.com/zachxbt/status/2040055757211885953?s=20" rel="noopener noreferrer nofollow">exploits exposed</a> gaps in Circle’s enforcement actions across its USDC stablecoin infrastructure. He cited 15 incidents totaling more than $420 million in alleged illicit funds. He wrote that Circle markets USDC as a safer and regulated alternative to Tether’s USDT. He argued that compliance decisions produced real consequences for affected users.</p>
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
  <p>1/ Welcome to the Circle <a href="https://twitter.com/search?q=%24USDC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$USDC</a> files.</p>
  <p>$420M+ in alleged compliance failures since 2022, including fifteen cases of the US-regulated stablecoin issuer taking minimal action against illicit funds. <a href="https://t.co/OiWZz5MrVM" rel="noopener noreferrer nofollow">pic.twitter.com/OiWZz5MrVM</a></p>
  <p>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/2040055757211885953?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">April 3, 2026</a></p>
 </blockquote>
</div>
<p>He highlighted the Drift Protocol exploit this week, which totaled over $280 million. He stated that the exploiter bridged about $232 million USDC from <a href="https://blockonomi.com/solana-sol-plunges-under-80-amid-rising-geopolitical-concerns/" rel="noopener noreferrer nofollow">Solana</a> to Ethereum. He said the attacker used Circle’s Cross-Chain Transfer Protocol across more than 100 transactions in six hours. He added that Circle did not freeze the USDC during that period.</p>
<p>ZachXBT said more than 10 decentralized finance protocols on Solana suffered indirect impact from the exploit. He claimed the attacker laundered funds openly across Circle’s native bridge.</p>
<blockquote>
 <p>He stated, <em>“Despite the attacker laundering funds over six consecutive hours across Circle’s own native bridge, no USDC was frozen.”</em> He maintained that Circle had tools available to intervene earlier.</p>
</blockquote>
<h2 id="usdc-cases-span-drift-and-cetus-exploits">USDC Cases Span Drift and Cetus Exploits</h2>
<p>ZachXBT also referenced the Cetus Protocol exploit from May, which he valued at $223 million. He said the exploiter bridged 61 million USDC from <a href="https://blockonomi.com/grayscale-and-canary-capital-introduce-sui-etfs-for-direct-token-exposure/" rel="noopener noreferrer nofollow">Sui </a>to Ethereum within 90 minutes. He stated that both the Cetus team and private experts asked Circle to freeze the theft address. He wrote that Circle blacklisted the address one month later.</p>
<p>He said the USDC had already been converted to ETH by the time Circle acted. He described this delay as a repeated pattern across multiple cases. He added that the $420 million figure reflects only major public incidents. He wrote, “The real figure is likely significantly higher.”</p>
<p>Blockchain analytics firm <a href="https://www.elliptic.co/blog/drift-protocol-exploited-for-286-million-in-suspected-dprk-linked-attack" rel="noopener noreferrer nofollow">Elliptic</a> linked the Drift exploit to indicators tied to North Korea. Elliptic said it identified signs suggesting involvement by the Democratic People’s Republic of Korea. ZachXBT did not attribute the attack directly but referenced the analytics findings. He said stronger coordination across platforms could limit future incidents.</p>
<blockquote>
 <p>Circle addressed the claims in a statement to The Block. A spokesperson said, <em>“Circle is a regulated company that complies with sanctions, law enforcement orders, and court-mandated requirements.” </em></p>
</blockquote>
<p>The company added that it freezes assets when legally required and protects user rights and privacy.</p>
<p>Circle’s USDC ranks as the world’s second-largest stablecoin with over $77 billion in circulating supply. The company has called for clearer United States regulations to support adoption. Earlier this year, ZachXBT joined the crypto investment firm Paradigm as an incident response advisor.</p>
<p>The post <a href="https://blockonomi.com/circle-under-fire-as-zachxbt-flags-420m-usdc-cases/" rel="noopener noreferrer nofollow">Circle Under Fire as ZachXBT Flags $420M USDC Cases</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.</p>

Circle Under Fire as ZachXBT Flags $420M USDC Cases

Table of Contents

Blockonomi

Other articles published on Apr 3, 2026

Join our free newsletter for daily crypto updates!