Circle can freeze your USDC, but apparently they're in no rush when the money's actually stolen.
The Summary
- ZachXBT accused Circle of slow response times freezing USDC across more than $420 million in illicit funds, citing over a dozen cases including the recent $280 million Drift Protocol exploit
- Circle can instantly freeze USDC addresses but often waits days or weeks after receiving reports of theft, letting attackers move or swap funds
- This exposes the gap between what centralized stablecoins promise (programmable money) and how they actually operate (slow, opaque decision-making)
The Signal
The most popular stablecoin after Tether just got called out for being terrible at the one thing centralized stablecoins are supposed to be good at: emergency intervention. ZachXBT, the on-chain investigator who's recovered hundreds of millions in stolen crypto, documented over a dozen cases where Circle took days to freeze USDC addresses even after being handed clear evidence of theft. The Drift Protocol hack alone was $280 million, and the total across all cases exceeds $420 million.
This matters because USDC's entire value proposition lives in a narrow band. It's centralized enough that Circle can freeze addresses, which makes regulators happy and banks willing to touch it. But it's supposed to be decentralized enough to move fast when speed matters. Turns out neither is quite true. When hackers drain a protocol, they have a window measured in hours to move funds through mixers, swap into other tokens, or bridge to chains where tracking gets harder. Circle has the technical ability to freeze those funds instantly. They just don't.
The reasons are probably boring: legal review, internal processes, risk management theater. But the effect is clear. If you're building on USDC, you're building on a stablecoin that can revoke your funds but won't necessarily protect them. The centralization gives you all the risk and none of the speed. Meanwhile, every day Circle waits is another day stolen funds get laundered into assets they can't touch.
The Implication
If you're holding serious money in USDC, understand what you actually own. It's not permissionless. It's not even reliably interventionist. It's Schrodinger's stablecoin, centralized when convenient for Circle and slow when you need them to act. For developers, this is a reminder that stablecoin infrastructure still has single points of failure that move at corporate speed. Watch for protocols to start pricing in "Circle response time" as a security variable, or for insurance products that cover the gap between when a hack happens and when Circle finally freezes the money.
Source: The Block