Post

6/ In October 2022 Mango Markets was exploited for $110M. The exploiter transferred $57.5M to his Circle deposit address on Solana and withdrew the funds to Ethereum. He was later charged by the SEC. Despite the connection the funds were never frozen onchain. Theft address yUJw9a2PyoqKkH47i4yEGf4WXomSHMiK7Lp29Xs2NqM

7/ In August 2022 Nomad Bridge was exploited for $190M. ~45M USDC sat freezable for 30-45 min in three exploiter addresses before being fully swapped out. Despite the large hack being widely reported, the addresses were never blacklisted by Circle. Theft addresses 0xbf293d5138a2a1ba407b43672643434c43827179 0x56d8b635a7c88fd1104d23d632af40c1c3aac4e3 0xb5c55f76f90cc528b2609109ca14d8d84593590e

8/ In April 2024 I published a report on Lazarus Group detailing how funds from 25+ hacks were laundered and converted to fiat. Law enforcement submitted freeze requests to four stablecoin issuers: Circle, Tether, Paxos, and Techteryx for two addresses in relation to the report. The other three issuers acted promptly. Circle took 4.5 months longer to freeze both addresses (verifiable onchain).

9/ In December 2023 Ledger, the largest hardware wallet company, fell victim to a supply chain attack which resulted in a phishing drainer being added to its Ledger Connect kit and $600K+ in assets stolen. USDC sat in the theft address for 3+ hours without action from Circle. Tether froze the stolen USDT in the same address. Theft address: 0x658729879fCa881D9526480B82aE00EFc54B5c2d"

10/ On July 9, 2025 GMX was exploited for $40M. 9M USDC sat for 2+ hours and was partially bridged from Arbitrum to Ethereum via CCTP. While the exploiter later returned assets minus a $5M bounty, the USDC was not frozen during the 2+ hour window. Theft address 0xDF3340A436c27655bA62F8281565C9925C3a5221

11/ In September 2023 Remitano was hacked for $8.5M from its hot wallets on multiple chains. 441K USDC sat in theft addresses for 8 hours without action from Circle. Tether froze 1.4M USDT in the same addresses. Theft addresses CznNhNTBduDTbAUsFbJrCfLCrgzpyNWZwXpbVSkH7p3u 0x74530e81e9f4715c720b6b237f682cd0e298b66c

12/ In November 2022 a DeFi builder had ~$20M stolen by a threat actor from multiple wallets on various chains. 513K USDC sat in a theft address for one month and no freeze was executed by Circle while a request was sent out. Tether froze stolen USDT in the same address. Theft address 0x741564f5563abbe85f1b091eb39e38c000cb3e70

13/ In July 2025 I published research on DPRK IT workers infiltrating crypto businesses. Between October 2022 and January 2025, Circle users withdrew USDC to three IT worker payment addresses. These addresses were three hops from a DPRK forfeiture address and two hops from an address previously blacklisted by Tether. The DPRK ITW addresses in the cluster were never blacklisted by Circle. Circle withdrawal address 0x241d2b20f2c26a2541a0f121d6a33c29cb4cfe69 0x3131f63378cedc21a9c2fdf6574248a8cb7eec7a 0x5c411cb174c2e163f6465252ae895f3e3e5a8792

14/ In June 2025 a US DOJ civil forfeiture complaint was filed in relation to a $225M USDT seizure linked to a Southeast Asian pig butchering syndicate. 1.7M+ USDC linked to the illicit funds was transferred through intermediary addresses to a Circle deposit address. Circle deposit address: 0xb4875c44fa2b00291637793196f077b197daaa87 Civil Action No. 25-cv-1907

15/ In October 2024 Radiant Capital was hacked by Lazarus Group (Apple Jeus) for $58M. The attacker drained USDC from victims via open approvals and chainhopped from Hyperliquid to Arbitrum using USDC. Multiple instances had USDC sitting in theft addresses for hours with no freeze action from Circle. Theft addresses 0x52263cAEc2e144C3A84cc16d014157360Ac85A89 0x00E1559184Bf1da0256a495ae9BAec11BCA60eb7 0x7997e80F4bD9563d61EE4D06108f7D6cEB23Ab21 0x60ABA279E49E5A05DC7e3c84F2204a6Afb032119 0x5b10daEdC2D7B5CE47f6B3072188f758f1b14481 0x34aa91e574aa963675107011DcF0392C5521005a 0x348FC4DfdCD3427D8A4B43Ad965B4443d55CF955

16/ In March 2025 law enforcement from multiple jurisdictions seized Garantex infrastructure. Garantex had been OFAC sanctioned since 2022. Tether froze $22M in connected addresses. Circle took no action on 200K+ USDC in the same addresses. Garantex address: 0xb271036d95b205a26bae5cb2d4eb922c000903a2"

17/ On February 21, 2025, Bybit was hacked by Lazarus Group for $1.5B, widely reported across mainstream media. On February 28, 106K USDT and 338K USDC consolidated to theft address 0xDa2. Law enforcement, Bybit, and private sector experts submitted freeze requests to both Tether and Circle. Tether froze the address within hours. Circle took 24 hours longer to act. Theft address: 0xDa2e12E94060720581994eEc870F83d9C7200c2c

@zachxbt Im keeping this one

@zachxbt Is @avi_eisen out of prison yet? 🤭

@zachxbt holy hell, seeing all of these laid out in one spot is crazy - great work as always man!

@bellx_crypto thanks I have been trying to document as many examples as possible

@zachxbt 4.5 months...absolutely speechless. 😵‍💫

@zachxbt maybe circle are North Korean themselves

@zachxbt now we wait and see if they will actually implement any sort of process changes over there...🤞

@bellx_crypto if the problem stems from leadership I am skeptical it changes

@zachxbt I see no pattern here. x.com/the_jungledon/status/204…

@zachxbt 🧐 @threadreaderapp unroll

@yasushetamarki @zachxbt @yasushetamarki Salam, you can read it here: threadreaderapp.com/thread/204… Enjoy :) 🤖

@zachxbt Circle has shown its interest isn't to consumers or blockchains themselves, but to something more cryptic... Seriously, thank you Zach for being a champion and defender for everyday ppl and builders. 🙏

@zachxbt god bless zachxbt

@piggedup @zachxbt They will spin the block like the USA did 😉

@zachxbt Not all people are so old in the world of cryptocurrencies and I include myself, and how good to know this type of information to be more and more alert, this shows that the company is not in favor of its users and they should be punished.

@02XRP @zachxbt youtube.com/watch?v=q4qVnLrtm4…

@zachxbt x.com/votesa/status/2040061418…

@logantoday It’s one thing if you could not possibly have known the illicit activity was occurring It’s another thing when you do know it occurs with strong evidence

@zachxbt You dont get it. Circle acts mostly on US based court orders and requests from US investigators. They don't freeze based on "I think so". Tether on other hand had a badge of offshore coin targeted by US authorites. This is why Tether is trying so hard to show compliance to public

@zachxbt Circle actually shows way more reasonable legal approach compared to tether because tether can't be really sued in offshore jurisdiction in case it freezes something by mistake. Circle can be sued in US. That's why the more careful aproach.

@zachxbt I think you could safely say @circle have been responsible for more laundered money than could ever have been pinned on @TornadoCash and @rstormsf

@zachxbt @laurashin robin hood arc ?

@zachxbt Oh cool... There are still some individual cases that were reported I can't just remember it and are seven figures

@zachxbt @DesChan13 $lmao x.com/frenchtardi0/status/2040…

@zachxbt To be noted, there also was several well identified Nomad bridge hacker wallets , with 7 figures, that continued to deploy their stolen USDC in ethereum DEFI ( lending...), Circle never froze those usdc.

@zachxbt @lukecannon727 @0xAnteater Don’t they need a court order to freeze anything?

@zachxbt This is quite crazy that they are still reluctant in carrying out swift responses

@zachxbt @jerallaire hello x.com/pageboy/status/204006844…

@zachxbt i honestly think its the USDC team behind the exploits x.com/PesoLxve/status/20400692…

@zachxbt @0xBiZzy @pierre_crypt0 Lmao 😂

@zachxbt @pierre_crypt0 I mean I would understand a little if there were any questions as to whether the address was actually connected to the hacks but I would assume that it’s pretty definitive in pretty much all cases lol…

@0xBiZzy @pierre_crypt0 yes nearly all of the examples I shared were very public incidents

@zachxbt @0xBiZzy @pierre_crypt0 Users don't benefit huh, sooo basically Jeremy thinks thieves and state sponsored hackers are equally important users of the protocol and maybe they have feelings too guys........what a crack head!

@zachxbt Your move @circle x.com/Philneeds/status/2040083…

@zachxbt Only solution is for big companies to stop using usdc, and stick to usdt, if they can't collect fees, it will hurt them more

@zachxbt @jerallaire gonna get his legal to draft a no-exposure whitewashed response to this faster than they freeze USDC on its way to DPRK

@Falafelbg9 I don't think so (I'm holding on to USDC), EURC has much less liquidity, but even if it were to break out, I think it would be for a while. I'm not putting my hand in the fire for anything, but I think it's pretty safe, yes.

@ancientgrninja @zachxbt x.com/DegenClubGR/status/20400…