On-chain investigator ZachXBT has published a report titled “The Circle USDC Files,” alleging more than $420 million in compliance failures related to Circle’s USDC stablecoin since 2022. The analysis, shared on X on Friday, compiles a series of high-profile decentralized finance (DeFi) exploits in which Circle allegedly did not deploy on-chain compliance tools to address illicit activity.
Allegations detailed in new report
The report asserts that multiple DeFi incidents over the past two years involved USDC and that, in aggregate, the cases point to lapses totaling more than $420 million. According to ZachXBT, the incidents span various protocols and timelines, with each example purportedly illustrating gaps in how USDC-related activity was monitored or mitigated on-chain.
The investigator’s post centers on the use of on-chain controls that stablecoin issuers can employ to manage funds linked to suspected illicit activity. The report claims Circle did not consistently use these mechanisms during or after several noted exploits. The allegations have not been independently verified.
Background: USDC and on-chain compliance
USDC is a U.S. dollar–pegged stablecoin issued by Circle, designed to maintain a 1:1 value with the dollar and widely used across crypto exchanges, wallets, and DeFi applications. Because stablecoins operate on public blockchains, issuers can, in some cases, implement compliance features intended to address sanctioned addresses, theft, or other illicit behavior.
Why it matters
The claims add to ongoing industry scrutiny over how centralized stablecoin issuers oversee activity involving their tokens, particularly across fast-moving DeFi markets where exploits and hacks remain common. The report may intensify debate around the balance between rapid on-chain enforcement, user protections, and the operational limits of compliance tooling in decentralized environments.