Written by: Strident Citizen

Translated by: Chopper, Foresight News

On March 23, Circle froze the USDC balances in the hot wallets of 16 cryptocurrency companies.

These addresses are not hackers, not sanctioned entities, nor North Korean state agencies. They are normal businesses, conducting operations and processing transactions for users.

On-chain analyst ZachXBT exposed this matter. After directly communicating with one of the affected companies, he learned that the freeze was related to an ongoing U.S. civil case, but the details of the case were not disclosed. After reviewing on-chain behavior, he determined: with basic verification, it was clear these were operational wallets. The platforms mentioned in his Telegram include: Ranj.gg, Clank.gg, Whale.gg, Goated.com, 500 Casino, Pepperstone, FXPro, HeroFx, AMarkets. They include exchanges, casinos, and forex platforms, with no obvious connections between each other.

The business operations of these companies have been directly affected, but they have not been publicly informed of all the details.

ZachXBT's commentary hits the nail on the head: "When something really goes wrong, you cannot protect the users, yet you respond swiftly to a faulty directive."

This sentence summarizes the core of the incident. But to understand why it is so important, you need to grasp the complete timeline of events.

What is the freeze function?

Before sorting through a series of events, it is necessary to clarify the mechanism.

USDC is fundamentally different from Bitcoin and Ethereum. It is a token built on a public chain, and its smart contracts have a built-in blacklist feature. Circle holds the administrative key. Once an address is added to the blacklist, it can no longer send or receive USDC. The balance does not disappear, but becomes permanently inactive until Circle removes it from the list.

This process has no appeal period, no automatic notification, and no minimum amount limit. Circle can freeze $1 or $100 million. It can act based on government requests, court orders, internal assessments, or any reasons it deems "sufficiently compelling." The terms of service grant it significant discretion.

This architecture has never been a secret, but rather a deliberate design choice. Circle built it this way and even promoted it as a feature. Its rhetoric to regulators and institutional clients has always been: we are a responsible stablecoin, we have control capabilities, and we can act when necessary.

The freeze function has existed since USDC was launched, and the contract code is visible to everyone. Crypto researchers have pointed out from day one that this represents a centralized risk. Yet the response from Circle and its institutional supporters has always been: this power is intended to protect the ecosystem, not to harm ordinary users.

Five years have passed, and a series of events have shown that the reality is quite different.

It wasn't until ZachXBT repeatedly named names that people finally began to loudly question: who requested this? And who decided that a faulty application was sufficient to paralyze 16 businesses in one afternoon?

This is not the first time

ZachXBT's accusations against Circle have been ongoing for over a year. The pattern of each event is always the same.

In February 2025, the Bybit exchange was hacked, with $1.5 billion stolen, linked to the North Korean Lazarus Group. On-chain traces clearly showed USDC rapidly flowing into specific addresses. ZachXBT publicly exposed these addresses and directly called on Circle co-founder Jeremy Allaire to take action. Other platforms responded quickly: ThorChain blacklisted the addresses, FixedFloat froze stablecoins, and Coinex and Bitget took subsequent action. Only Circle remained indifferent, allowing the addresses to continue circulating and North Korean hacker funds to keep transferring.

Months later, ZachXBT brought even worse news.

In July 2025, his investigation revealed that North Korean IT professionals primarily used USDC as a payment channel. Not USDT, not ETH, but this "cleanest" stablecoin. He pointed out that transactions involving tens of millions of dollars were at stake and bluntly stated: "They boast compliance while failing to monitor or freeze such activities at all."

Circle made no public response. In the same month, Circle officially applied for a national banking license in the U.S.

In October 2025, Coinbase reported a theft. Circle immediately froze four EVM addresses, claiming they were related to the stolen funds. After verification, ZachXBT found that these wallets only contained DAI, with no USDC at all. Circle froze wrong wallets containing wrong assets. He called it one of the most pointless freeze operations he had ever seen.

In January 2026, SwapNet users were robbed of 3 million USDC, which lingered in the original address for over 8 hours without Circle intervening at all. ZachXBT directly labeled Circle as a "bad actor" and posed a heavy question to the developer community: "As a centralized stablecoin issuer, you never take responsibility for users; who else should build applications on USDC?"

Then came the present. 16 operational commercial wallets were frozen due to an undisclosed civil case. Any analyst could use basic tools to determine within minutes that these were active business infrastructures.

Five events, the same pattern.

The compliance system only operates in one direction

The most intuitive way to understand Circle's true behavior is to compare when it acts quickly and when it drags its feet or is perfunctory.

• In 2022, when the U.S. Treasury sanctioned Tornado Cash, Circle froze over 75,000 relevant USDC addresses within hours, without hesitation.
• In May 2025, following a court order in the LIBRA Meme coin case, Circle quickly froze approximately $57 million USDC.
• In this case, a civil application described by ZachXBT as "full of loopholes," Circle also decisively froze 16 commercial wallets.

On the other hand:

North Korean state-level hackers brazenly laundered money through USDC for months, with clear on-chain traces, while Circle remained indifferent until researchers publicly pressured them.

The 3 million stolen USDC lingered at the original address for 8 hours, and Circle needed public opinion pressure to act.

The difference is not in the size of the harm. Bybit's loss of $1.5 billion and North Korean funds worth tens of millions are both serious matters. The difference lies solely in: who is making the demands. In the face of public authority, the response is swift; in the face of victims waiting for help, the proactive response is nearly zero.

According to AMLBot data, Circle has blacklisted approximately 372 addresses since the launch of USDC. In contrast, Tether, which has been criticized by institutions for being "opaque," has frozen assets of over 2,500 addresses, totaling about $1.6 billion, collaborating with over 275 law enforcement agencies. In comparison, Circle has fewer blacklisted addresses, a slower response speed to victim incidents, and its communications team often emphasizes compliance.

The comparison is very awkward: the industry has long been self-deluded, thinking that Tether is a black box while Circle is a stream of purity. But the data does not support this narrative.

Existing legislation has not solved the problem

I have closely studied two major stablecoin bills, neither of which address these issues.

The GENIUS Act requires all stablecoin issuers to have the technical capacity to legally seize, freeze, or destroy tokens. Circle had this capacity before the bill was passed. What the bill clearly states is: there is an obligation to cooperate with legal government directives. But it does not establish any reverse obligation: when users or businesses experience theft or wrongful freezes, the issuer must take action.

The CLARITY Act was promoted as a breakthrough regulatory market structure bill for the crypto industry. After the latest legislative text was exposed, the market reacted strongly: the proposal would prohibit platforms from directly or indirectly providing yields on stablecoins. Circle's stock price plunged about 18% in a single day, and investors directly repriced its business model.

More critically, the CLARITY Act also does not provide any recourse mechanisms for users and businesses facing wrongful freezes. It only stipulates what regulatory agencies can do, not what Circle must do when 16 operational wallets are frozen due to a clearly problematic application.

Both bills tilt power towards regulated issuers and their government partners, without offering any protection to ordinary users.

Compliance, compliance for whom?

USDC is not a neutral financial instrument.

It is a token pegged to the U.S. dollar, running on a public chain, obeying a private company that is itself subject to U.S. regulation. This is not inherently wrong. There is reasonable logic in supporting compliant stablecoins with freeze functions: recovering stolen funds, freezing sanctioned entities, enforcing court orders is indeed useful infrastructure.

But people must recognize its essence instead of believing its marketing rhetoric.

The narrative is: transparency, full reserves, compliance. What is deliberately omitted is: compliance is only directed one-way towards the government.

Circle acts quickly because it is called upon by those in power; it drags its feet or misidentifies targets and freezes wrong assets without any recourse channels.

ZachXBT is not an anti-Circle person. He has publicly stated that he trusts Circle more than several issuers. Precisely because of this, his continued criticism is harder to ignore. He is not a troll merely criticizing for the sake of criticism, but a researcher who continuously tracks funds and discovers Circle's inaction when victims need help, and is willing to speak out about it.

He did not say Circle is corrupt. What he said is: Circle has the tools, sees the problems, but only acts when compelled by law. And when faced with a clearly faulty civil case directive, it does not even verify on-chain data before executing.

This is not a compliance failure; this is a policy choice. And this choice affects all developers, businesses, and users building ecosystems on the assumption that "issuers will be mutually responsible."

The answers are becoming clearer

Every time ZachXBT posts mentioning Circle, the same plot cycles again. The community engages in heated discussions, Circle remains silent or perfunctory, the news hype fades, and its stock price continues to rise. At least until today, that has been the case.

The chain where your USDC resides, Circle can freeze any address at any time for any reason it deems sufficient.

The question is no longer "can it," you already know it can. The GENIUS Act just clarifies the legal framework for this power.

What you should be asking is not a technical question, but a political one:

• Who is Circle truly accountable to?
• When it takes such actions, who is ordering it?
• When it drags its feet or remains inactive, whose interests is it protecting?

From the patterns observed in the five incidents, the answer remains consistent: rapid response to power directives, delayed and absent initiatives toward victims seeking assistance, and even complete misidentification of targets as in this case.

These 16 companies frozen due to an unnamed civil case are just the latest node in this pattern. And it is nearly certain they will not be the last.