ZachXBT Says Circle Failed to Freeze $420M in Stolen USDC Across 15 Cases

Highlights:

• ZachXBT report shows Circle did not freeze stolen USDC across several cases.
• Drift hack shows attackers moved USDC for six hours before any freeze action happened.
• Slow USDC freezes let attackers move and convert funds before anyone can stop them.

On-chain investigator ZachXBT stated in an X post that Circle failed to freeze over $420 million in stolen USDC across 15 cases recorded between 2022 and 2026. He shared the findings in a thread titled “Circle $USDC files,” where he documented how attackers moved funds during active exploits. These attacks took place on DeFi protocols on networks such as Solana and Ethereum.

ZachXBT claims Circle ignored law enforcement requests to freeze $420M in stolen USDC across multiple hacks. pic.twitter.com/vz7QwOmEp2

— Rishabh Narang (@0xrishng) April 4, 2026

ZachXBT explained that Circle has the ability to freeze USDC directly at the smart contract level during hacks. However, he stated that the company did not act during the first hours when funds still remained in USDC form. This delay enabled attackers to transfer USDC cross-chain in a matter of hours and convert it into other assets. He added that freezing funds early during a hack helps limit movement and improves recovery chances.

The report also compared Circle’s response during exploits with its actions in legal cases. In a short period, Circle recently froze 16 wallets associated with a civil lawsuit in the United States. One wallet belonged to the DFINITY Foundation. ZachXBT used that case to show that Circle can act quickly when required under legal orders.

Drift Hack Shows Delay in Freezing Stolen USDC

ZachXBT pointed to the April 1 Drift Protocol hack on Solana as a clear case of delay. Attackers used a compromised admin key and a manipulated oracle to access funds. They drained the main vault in about 12 minutes.

#PeckShieldAlert Drift Protocol @DriftProtocol has been exploited, resulting in a loss of over $285M – more than 50% of its TVL. $DRIFT has plummeted by -37%.

The exploiter has already bridged the stolen assets from #Solana to #Ethereum via the CCTP TokenMessengerMinterV2,… pic.twitter.com/EZE4tP0f6c

— PeckShieldAlert (@PeckShieldAlert) April 2, 2026

After the exploit, the attacker converted stolen assets into USDC on Solana before moving funds across chains. The attacker used Circle’s Cross-Chain Transfer Protocol to transfer about $232 million from Solana to Ethereum. These transfers occurred across more than 100 transactions over six consecutive hours during U.S. business hours.

ZachXBT stated that Circle received alerts about the attacker’s wallets during those six hours while funds still remained in USDC form. However, the company did not freeze those wallets during that period. This allowed the attacker to move USDC to Ethereum and later convert it into ETH before any freeze action took place.

ZachXBT stated, “Circle was asleep while millions in USDC moved through its bridge during the Drift exploit over several hours. This delay allowed the attacker to move funds before any freeze action took place.”

ZachXBT Report Raises Concerns About How and When Action Happens

The ZachXBT report also listed earlier incidents where Circle delayed freezing USDC during active exploits. In February last year, attackers linked to the Lazarus Group hacked Bybit and stole $1.5 billion. Tether froze related wallets within hours during that incident, while Circle delayed action by about 24 hours.

In May last year, attackers exploited Cetus Protocol and stole $223 million. They moved $61 million in USDC across chains within 90 minutes using cross-chain tools. Circle froze the address weeks later, after the funds had already been converted into ETH.

In a related case, attackers exploited Nomad Bridge and moved $45 million during a 30 to 45-minute window. The report stated that Circle did not freeze the funds during that period. In separate SwapNet cases, attackers left stolen USDC in wallets for hours and days, yet Circle did not act immediately despite alerts.