Worked example · 2022-20

Circle USDC — $420M+ Compliance Failures / Stablecoin Issuer Inaction — 2022-2026

Loss: $420M+ in alleged compliance failures across 15 documented cases since 2022. US-regulated stablecoin issuer (Circle) took minimal action against illicit funds flowing through USDC.
OAK Techniques observed: none — pending reconciliation, not an absence of fit. OAK-T7.008 (Stablecoin Issuer Freeze-Asymmetry Laundering) matches this file's mechanism closely, but tagging it would wire a direct contradiction into the relationship graph: techniques/T7.008-*.md states that Circle froze sanctioned USDC while Tether did not, and that laundering therefore shifted toward USDT. This file asserts the opposite polarity — that Tether freezes aggressively, Circle demonstrably does not, and operators therefore route through USDC. Both are in the corpus and both cannot be right as written. The likeliest reconciliation is time-scoping (a 2022 sanctions-order response versus a 2022–2026 general-illicit-funds posture), which would let both stand if each is stated precisely. Resolve the Technique page and this example against each other before tagging. (The prior field claimed bare OAK-T7, which resolves to no Technique.)
Attribution: confirmed — Circle (USDC issuer). ZachXBT investigation published April 2026 documenting 15 cases of minimal action.
Key teaching point: The Circle USDC files demonstrate the stablecoin issuer freeze asymmetry pattern: when illicit funds are held in USDC, the issuer (Circle) has the technical capability to freeze them — unlike decentralized assets (ETH, BTC). But Circle's documented pattern across 15 cases shows minimal action, making USDC the preferred stablecoin for laundering. This is the inverse of the Tether freeze cooperation model. Detection approach: cross-reference stablecoin issuer freeze rates across USDC, USDT, DAI, and FDUSD; the issuer with the lowest freeze rate is the laundering destination of choice — threat actors route through the issuer that freezes least.

Summary

In April 2026, ZachXBT published "The Circle $USDC Files" documenting $420M+ in alleged compliance failures since 2022. The investigation identified 15 cases where Circle — a US-regulated stablecoin issuer — took minimal action against funds confirmed to be from hacks, exploits, and scams.

The freeze asymmetry between issuers:

Tether (USDT): Aggressive freeze policy. Blacklists addresses within hours/days of confirmed illicit activity.
Circle (USDC): Documented pattern of inaction. 15 cases with minimal response.
Result: Threat actors route through USDC specifically because Circle's freeze response is weaker.

This is a detection/response gap at the institutional layer: the technical capability to freeze exists (USDC is a centralized, freezable contract), but the institutional will to use it is inconsistent. The gap between "can freeze" and "does freeze" is the laundering window.

Timeline

When	Event	OAK ref
2022-2026	15 documented cases of USDC issuer inaction on confirmed illicit funds. $420M+ in total	T7 issuer freeze gap
2026-04-03	ZachXBT publishes "Circle $USDC Files" investigation	(public disclosure)

What defenders observed

Freeze capability without freeze action = the detection gap. Circle CAN freeze USDC at the contract level (like Tether does). The gap is not technical — it's institutional. The decision not to freeze is the enabling factor.
Threat actor routing through USDC specifically. When an exploiter has a choice of stablecoin to convert to, the observed pattern is routing through USDC rather than USDT — because USDT freezes are faster and more consistent. The issuer's freeze reputation determines laundering path selection.
US-regulated ≠ effective compliance. Circle is a US company subject to US regulation. The $420M+ in documented inaction demonstrates that regulatory jurisdiction does not guarantee compliance effectiveness.

What this example tells contributors

Stablecoin issuer freeze rate is a measurable T7 detection metric. Freeze rate = (addresses frozen) / (addresses reported with confirmed illicit activity). Per-issuer freeze rates can be tracked and compared. OAK T7 detection data sources should include "issuer freeze rate" as a metric — it's the institutional equivalent of a detection rate.
Freeze asymmetry drives laundering path selection. Threat actors are rational: they route through the issuer with the lowest freeze probability. Making freeze rates public creates competitive pressure on issuers to freeze more consistently.
Issuer compliance is a detection data source, not just a response mechanism. The freeze decision itself (yes/no on each reported address) is a data point that reveals the issuer's posture. Aggregating these decisions across incidents produces a compliance effectiveness score.

Public references

ZachXBT — Circle $USDC Files (X/Twitter)
15 documented cases. $420M+ in alleged compliance failures.
Circle: US-regulated issuer of USDC stablecoin.
USDT (Tether): comparison issuer with documented aggressive freeze policy.