On-chain investigator ZachXBT says more than $420 million in suspicious USDC has drawn little follow-up from issuers and law enforcement. He argues that slow or inconsistent freezes have turned “compliant” USDC into a preferred tool for hackers who move large amounts of stolen crypto.
How $420M in Suspect USDC Slipped Through
ZachXBT has tracked suspected exploit and hacking wallets that, in total, moved over $420 million in USDC across chains. He says many of these wallets stayed active for hours or days, even after public posts and on-chain evidence flagged them.
In several cases, attackers drained assets from protocols, swapped them into USDC, and bridged them using Circle’s Cross-Chain Transfer Protocol. He claims Circle “had hours” to freeze part of these flows but did not act until most funds were gone or laundered.
ZachXBT points to earlier incidents, including the Bybit-related hack, where addresses holding USDC linked to a $1.5 billion exploit remained only lightly restricted. Those addresses held a small slice of the stolen total, but he says they still showed a pattern of hesitation around freezing power.
Circle’s Freeze Power Under Scrutiny
Circle can blacklist addresses and freeze USDC when it receives legal orders or flags from its compliance systems. So far, it has frozen hundreds of addresses, and it recently hit at least 16 exchange-linked hot wallets in a broad compliance sweep.
ZachXBT argues that this record cuts both ways. On one hand, Circle can and does freeze funds quickly in some cases, but on the other hand, he says it failed to respond in time when DeFi users needed urgent protection during live exploits like the Drift hack on Solana.
He has publicly called Circle and its CEO “bad actors” for, in his view, missing clear chances to block active hackers while still freezing other corporate or exchange wallets. Circle has assisted some investigations and helped trace funds, but it has not answered all of ZachXBT’s specific claims about delays and missed windows.
For many traders, USDC still looks like a safer stablecoin because Circle holds licenses and works closely with regulators. However, ZachXBT says the $420 million in suspect flows shows how centralization can fail both on censorship and on user protection.
He warns that DeFi protocols and users now depend heavily on a single issuer that can freeze funds at will yet may not move fast enough during attacks.
READ MORE: COIN Stock on Edge as Coinbase Wins Conditional Bank Charter
