04.04.2026 17:38
**Key Findings from On‑Chain Investigations**
On‑chain analyst ZachXBT conducted a thorough review of USDC freezes that were never executed, uncovering fifteen separate incidents valued at more than $420 million. Each case revealed a window where Circle possessed both the technical capability and the contractual authority to block malicious addresses, yet chose not to intervene.
**The Drift Protocol Breach**
One particularly glaring episode unfolded on April 1, 2026, when the Drift Protocol fell victim to a $232 million hack orchestrated by North Korea’s Lazarus Group. Over six hours, attackers funneled the stolen assets through Circle’s Cross‑Chain Transfer Protocol, moving the funds from Solana to Ethereum during U.S. business hours. Despite clear visibility into the transfers, Circle remained silent, allowing the illicit bridge to remain live for the entire period.
**Swapnet and Cetus Protocol Incidents**
Two additional exploits further illustrate the pattern. In January 25, 2026, a $16 million loss erupted on the Swapnet platform, with $3 million of USDC left unprotected for two days while law‑enforcement and private investigators filed freeze requests that Circle denied. The compromised funds were swapped before a court order could take effect. Earlier, on May 22, 2025, the Cetus Protocol hack netted $223 million, of which Circle blacklisted 61 million USSC‑linked assets only after they had been converted to Ether—far too late to curb the damage.
**Circle’s Controversial Wallet Freeze Actions**
ZachXBT also highlighted a series of freezes that targeted ostensibly legitimate wallets. In March 2026, Circle temporarily locked 16 business accounts, including the DFINITY Foundation’s ckETH minting contract, amidst a civil lawsuit. Five of those wallets were reinstated after the legal dispute cooled, underscoring the irregularity of the action.
**Did Circle Neglect Stolen Funds?**
The cumulative evidence points to a systemic failure: Circle had the power to safeguard at least $420 million in illicit USDC streams yet did not act promptly—or at all—leaving victims and regulators scrambling. By juxtaposing instances of delayed response with moments of unnecessary freezing, the investigation paints a nuanced picture of an organization caught in a tug‑of‑war between proactive risk management and regulatory compliance.
**Broader Implications**
These revelations raise critical questions about the stewardship of stablecoin custodians and the transparency of their governance. As on‑chain forensics continue to expose gaps between protocol capabilities and actual practices, the industry may be compelled to adopt stricter safeguards, ensuring that funds can be secured the moment a breach is identified, rather than left vulnerable until after the fact.
