Allegations Against Circle's Compliance
On-chain investigator ZachXBT published a comprehensive report, titled the “Circle $USDC Files,” alleging compliance failures by Circle, the issuer of the $USDC stablecoin, due to its alleged inability to freeze hacked or illicit $USDC funds in a timely manner. A central assertion is that in each instance, another major stablecoin issuer, Tether, was able to freeze stolen funds more rapidly than Circle. The report highlights that Circle possesses the technical capability to instantly freeze $USDC, yet in numerous cases, this action was reportedly not taken with sufficient speed.
ZachXBT's allegations challenge this perception of timely compliance, focusing on the function of freezing funds to prevent the movement of stolen assets, and indicating a disconnect in Circle's operational effectiveness.
Documented Incidents and Delays
The report details multiple incidents. Two exploits are highlighted: the Drift Protocol exploit and the SwapNet hack.
The Drift Protocol exploit involved approximately $232 million in $USDC bridged by the exploiter, part of an estimated total of $200 million to $270 million drained from various assets. This included approximately $51 million in $USDC, $20 million in $SOL, $11 million in cbBTC, and $4 million in $WBTC. Following the exploit, the perpetrator reportedly began swapping stolen assets into $USDC and bridging these funds to Ethereum to acquire $ETH, purchasing 19,913 $ETH (approximately $42.6 million at the time). The report alleges Circle waited six hours to freeze the $USDC involved, despite the attack being publicly known for several hours and millions of $USDC actively swapped via the Cross-Chain Transfer Protocol (CCTP) from Solana to Ethereum.
Another case cited is the SwapNet hack, involving $3 million in $USDC. The overarching claim is a consistent pattern where Circle's response time in freezing stolen funds lagged behind that of other stablecoin issuers, specifically Tether.
Community Reaction and Market Impact
The crypto community reacted to ZachXBT's report with negative sentiment, with discussions surrounding the allegations recording sentiment scores as low as -81, and others reflecting -54, -64, -50, and -47. Community commentary included characterizations of the report as "damning" and allegations of "systemic failures" in Circle's response to thefts. Specific criticisms, such as the assertion that "Circle was asleep while many millions of $USDC was swapped," were widely shared.
While direct market impact on $USDC's trading volume was not observed, the Drift Protocol ($DRIFT) token, central to one of the incidents, experienced a direct market reaction during its exploit. $DRIFT declined by -12.7% as news of the exploit and subsequent fund movements became public.