Circle’s Delayed Response to Bybit Hack Funds Freeze

On-chain investigator ZachXBT noted that Circle delayed freezing USDC addresses linked to the Bybit exchange hack, allowing funds to move.

ZachXBT criticized Circle for not acting promptly to recover funds from the Bybit hack. The compromised funds are in USDC, which can be frozen by Circle, but current addresses remain active, allowing hackers to potentially launder the stolen funds.

One of ZachXBT’s main concerns is maximizing the recovery of stolen funds. Although Bybit has replenished its ETH losses, it still seeks to recover lost funds. He criticized Jeremy Allaire, co-founder of Circle, urging for accountability in controlling losses.

The USDC involvement in the Bybit hack comes as Circle seeks to enhance its stablecoin into a fully regulated payment method. USDC is increasingly popular in Europe, recognized recently by the Dubai Financial Service Authority. Over the past three months, USDC saw an increase of 3.1 billion tokens, mainly from issuing on Solana.

Tracing Active USDC Addresses Linked to Hacker Activity

ZachXBT identified USDC addresses associated with the hack holding about 115K tokens, a small fraction of the $1.5 billion stolen. Timeliness is crucial for fund recovery, as even $115K could be significant in different hacks.

Initially viewed as a risk, the ability to freeze USDC funds allows for the potential restoration of tokens to their rightful owners. To date, USDC has banned approximately 268 addresses without outright standards for selecting targets.

ZachXBT tracked addresses through initial ETH transfers, selecting USDC as a secondary asset due to its freezing ability. Despite risk of freezing, bad actors exploit stablecoins rapidly to avoid interception.

> Now 0xda2e has 338K USDC after receiving another 222.9K USDC after my post, showing its funds from the Bybit hack:
> 1). 0xda12 received 204.91 ETH from 0xe41B 31 hours ago in the following transaction…
> — ZachXBT (@zachxbt) February 28, 2025

Since USDC’s launch six years ago, many crypto users have been skeptical of its freeze function, given Circle’s broad ability to freeze addresses. However, Circle has not prioritized freezing small scale fund leaks, focusing more on larger issues as they mint significant amounts regularly. Despite this oversight, Circle has cooperated with the Bybit investigation, aiding in tracing efforts.

ZachXBT highlighted that Tether has already frozen 106K USDT as a response. Tether, originally targeted for censorship-free transactions, shifted its stance to crack down on addresses tied to scams, following expert advice from ZachXBT.

Various crypto protocols participated in the recovery efforts. Mantle Protocol blocked a substantial sum of $43M in mETH and delayed transfers to thwart hacker exploitation. Unfortunately, funds such as mETH and ETH remain unfrozen, permitting mixing, swapping, or hiding. Hackers further utilize DAI, a decentralized stablecoin that lacks freezing mechanisms.

Other projects effectively implemented fund freezes where feasible. ThorChain blocked blacklisted addresses to prevent fund mixing, while ChangeNOW DEX intercepted 34 ETH. The FixedFloat exchange froze 120K in USDT and USDC without Circle’s assistance. Similarly, Coinex and Bitget acted to freeze blacklisted addresses.