A recent investigative report by on-chain analyst ZachXBT has exposed significant compliance failures at Circle, issuer of the USDC stablecoin, alleging that over $420 million in stolen funds were not frozen in a timely manner since 2022. The 'Circle $USDC files' detail 15 cases where Circle delayed or failed to act against illicit transactions, including a critical 6-hour delay during the $285 million Drift Protocol exploit that allowed hackers to move funds. This scandal highlights the critical importance of robust compliance mechanisms and rapid response protocols in the cryptocurrency sector—principles that exchanges like Bybit prioritize to protect user assets and maintain market integrity. As regulatory scrutiny intensifies, the incident underscores the need for transparent, accountable operations across all crypto platforms.

Circle’s $420M Compliance Crisis: ZachXBT Exposes Massive USDC Scandal

On-chain investigator ZachXBT has unveiled a damning report alleging systemic failures by Circle, the issuer of USDC stablecoin, to freeze stolen funds exceeding $420 million since 2022. The investigation, dubbed the 'Circle $USDC files,' documents 15 cases of delayed or absent action against illicit transactions.

Notable incidents include a 6-hour freeze delay during the $285 million Drift Protocol exploit, allowing hackers to launder USDC batches. In another case, $3 million from a $16 million SwapNet theft remained untouched for two days despite law enforcement requests. Most strikingly, Circle took 24 hours longer than Tether to freeze funds linked to North Korea's Lazarus Group after their $1.5 billion Bybit heist.

The report highlights a pattern of regulatory complacency, with some addresses remaining unfrozen for months or entirely. Industry observers note the irony of Circle's inaction, given USDC's reputation as a compliant stablecoin.

ZachXBT’s Circle Files: USDC’s Biggest Compliance Scandal

Circle, the issuer of USDC, faces mounting scrutiny following a damning thread by blockchain investigator ZachXBT titled 'Welcome to Circle Files.' Over three years, Circle's alleged mismanagement of USDC has led to losses exceeding $420 million, tied to high-profile hacks and delayed freezes. ZachXBT's claims, backed by verifiable blockchain data, spotlight systemic failures in Circle's compliance protocols.

The April 2026 Drift Protocol exploit saw $232 million USDC bridged from Solana to Ethereum via Circle’s Cross-Chain Transfer Protocol—without intervention. Security researcher Specter noted the hacker’s deliberate avoidance of Tether conversions, signaling confidence in Circle’s inaction. Similarly, Circle lagged 24 hours behind Tether in freezing funds during the 2025 Bybit hack by Lazarus Group, which stole $1.5 billion.

These incidents underscore growing concerns over Circle’s reactive stance in crises, contrasting sharply with rivals like Tether. The Radiant Capital hack in October 2024 further exposed vulnerabilities, though details remain truncated in the original report.