ZachXBT, a well-known cryptocurrency investigator, has issued a warning regarding USDC, the second-largest stablecoin and long considered one of the most reliable coins in the crypto ecosystem. While USDC has built its reputation on strong regulatory compliance and stability—especially in contrast to market leader USDT—recent findings challenge its standing. ZachXBT claims that USDC and its issuer Circle, touted for regulatory rigor due to their US base, have repeatedly failed to act on crucial compliance measures, leaving hundreds of millions of dollars vulnerable to illicit activity.
How safe is USDC’s compliance track record?
Although USDC has successfully navigated various industry crises and is often seen as the gold standard for maintaining its peg, questions are mounting over Circle’s commitment to legal obligations. According to ZachXBT, Circle has allegedly failed to enforce compliance actions on more than $420 million worth of transactions linked to illicit or suspicious activity since 2022. These include instances where Circle did not freeze funds or blacklist addresses, even when evidence of wrongdoing surfaced.
Major incidents highlight persistent lapses
Several high-profile breaches illustrate the shortcomings. For example, during the Drift Protocol incident, around $232 million in USDC was funneled through bridge protocols, yet the necessary freezing of assets did not occur during the crucial window—despite indications that the perpetrator may have links to North Korea. In the SwapNet hack, $3 million escaped authorities and private sector requests for a freeze, moving just hours before a court order was put in place. The Cetus exploit involved $61 million ultimately converted and only blacklisted a month after the incident. Notably, in the Mango Markets attack, the perpetrator managed to transfer $57.5 million out of Circle’s accounts to Ethereum without intervention, a case later prosecuted by the SEC.
Further, the Nomad Bridge exploit saw roughly $45 million in USDC remain temporarily vulnerable for half an hour in three different wallets, yet no blacklist action was taken by Circle. These incidents, part of a series of 15 compliance failures between 2022 and 2026, raise persistent questions about USDC’s alleged regulatory edge over competitors.
Circle’s regulatory claims called into question
Circle positions itself as the most regulation-sensitive stablecoin on the market, underpinned by a robust compliance program and US legal backing. Its token contract even includes technical features allowing the freezing and blacklisting of assets. Terms of service explicitly reserve Circle’s right to restrict access if illegal use is suspected. Despite these provisions, ZachXBT argues that Circle has failed to leverage its tools when it mattered most, undermining its most powerful marketing argument.
The recent Drift Protocol hack, investigated in 2026, is yet another instance highlighting this discrepancy. Despite the existence of freeze mechanics and explicit service terms granting Circle the authority to act preemptively, the company has repeatedly missed the opportunity to intervene effectively and limit systemic harm.
“Circle develops excellent products, and I personally hold USDC. This is not intended as a hit piece, nor do I wish them to fail. However, their compliance decisions have had real-world consequences. Three years of repeated inaction has cost the crypto ecosystem hundreds of millions of dollars—even when law enforcement, private sector players, and their own infrastructure urged action,” ZachXBT wrote. “Circle has every resource necessary to do better, but it hasn’t. So I must ask: Who does Circle truly serve? As a regulated, publicly-listed US company, Circle owes both its users and the larger community a higher standard.”
The findings put fresh scrutiny on Circle, intensifying debate over the extent to which major stablecoin issuers fulfill their legal and ethical responsibilities. As regulators tighten their focus globally, market participants are demanding clearer, more proactive compliance from key actors in the digital asset space.
In response to mounting criticism, industry observers suggest investors and users exercise renewed caution, emphasizing the need to look beyond marketing claims when assessing stablecoin security. With the crypto landscape continually evolving, the long-held assumption that USDC represents the pinnacle of regulatory assurance may require reconsideration.
