Blockchain investigator ZachXBT has published what he calls the “Circle Files,” a thread alleging more than $420 million in compliance failures by USDC issuer Circle across fifteen separate crypto hack cases since 2022.
What ZachXBT Says the ‘Circle Files’ Show
On April 3, 2026, ZachXBT posted a thread on X titled the “Circle $USDC files,” alleging that the US-regulated stablecoin issuer took minimal action against illicit funds across fifteen cases dating back to 2022.
1/ Welcome to the Circle $USDC files.
$420M+ in alleged compliance failures since 2022, including fifteen cases of the US-regulated stablecoin issuer taking minimal action against illicit funds. pic.twitter.com/OiWZz5MrVM
— ZachXBT (@zachxbt) April 3, 2026
Source: @zachxbt on X
The thread frames the allegations around a pattern: that Circle, despite having the technical and legal authority to freeze USDC tied to exploits, repeatedly failed to act quickly enough when illicit funds moved through its stablecoin.
Among the cases highlighted by secondary reporting, the April 1, 2026 Drift Protocol exploit stands out. According to Crypto Briefing’s coverage, more than $280 million in USDC was bridged over roughly six hours during that incident without a freeze being executed.
Crypto Briefing’s report placed the broader total at more than $440 million in losses since 2022, slightly above ZachXBT’s own $420 million-plus figure. The discrepancy between the two totals has not been publicly reconciled, and neither figure has been independently verified case by case.
Why the Allegations Matter for Circle, USDC and Market Trust
Circle is not a peripheral player in crypto infrastructure. USDC carries an approximate $77.37 billion market cap with roughly $7.21 billion in 24-hour trading volume, making it the second-largest stablecoin by circulation.
Circle’s own legal risk-factor disclosures acknowledge that the USDC protocol network may refuse to process transactions and may facilitate the freezing or seizure of USDC under certain circumstances. The dispute raised by ZachXBT is not about whether these controls exist, but whether Circle applied them promptly and consistently when exploits were actively draining protocols.
For DeFi protocols and exchanges that hold significant USDC reserves, the question of how quickly an issuer acts during a live exploit is an operational risk factor. The Drift Protocol case, where ZachXBT’s thread alleges hours passed before any freeze, illustrates the gap between policy language and real-time response. This mirrors broader concerns about issuer transparency and accountability that have surfaced across the crypto industry in recent months.
Stablecoin trust depends on the belief that issuers will enforce their own compliance frameworks. Allegations of selective or slow enforcement, even if unproven, can erode confidence among institutional counterparties who rely on USDC as a settlement layer. The broader climate of regulatory scrutiny, visible in stories like the intersection of macroeconomic data and crypto market sentiment, adds pressure on issuers to demonstrate active compliance.
At press time, USDC traded at approximately $1.00 with no meaningful depeg, suggesting that markets have not yet priced in structural risk from the allegations.
What Questions the Release Raises Next
Circle has not publicly responded to ZachXBT’s thread as of publication. Any rebuttal, timeline clarification, or disclosure of internal freeze procedures would materially change the framing of these allegations.
The full fifteen-case dossier has not been independently reconciled line by line. Until each case is verified against on-chain records and Circle’s internal response timelines, the allegations remain attributed solely to ZachXBT’s investigation.
The crypto industry has increasingly turned to on-chain investigators like ZachXBT to hold institutions accountable, a dynamic also visible in how exchanges expanding into regulated jurisdictions face heightened scrutiny over compliance standards. Whether Circle addresses the specific cases or the broader pattern will likely determine how this story develops.
Key questions remain open: how quickly did Circle receive exploit notifications in each of the fifteen cases, what internal thresholds trigger a freeze, and whether any of the flagged funds were eventually recovered or blacklisted after the initial window passed. Regulators and counterparties will be watching for answers.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
