Circle Watched Hackers Bridge $232M for 6 Hours — and Did Nothing

Summary

• Circle had six hours during business hours to freeze $232 million in stolen USDC as hackers bridged it from Solana to Ethereum, but took no action.
• Circle's established policy is to wait for court orders or formal law enforcement involvement before freezing funds, leading to significant delays in response.
• Security professionals and law enforcement agencies are frustrated with Circle's slow freezing process, despite rapid identification of hacks and actionable intelligence.
• Amanda Wick analogized Circle's inaction to allowing unarmed bank robbers to steal money without intervention, highlighting a failure in proactive risk management.
• Circle is a registered money service business in the U.S. with AML/CFT obligations but is perceived as adhering only to minimal legal requirements, avoiding liability.
• Hackers in this incident specifically avoided USDT and used USDC, indicating awareness of Circle's slower freezing window and making USDC a preferred tool for laundering.
• There is a legal gap for crypto financial services, but Circle's hesitancy is criticized as performative compliance, undermining trust with regulators and victims.
• Circle's control over bridge architecture and freezing powers on-chain means inaction is a policy choice, not a technical limitation.
• This behavior raises operational and security risks for USDC holders, potentially impacting its adoption and reliability compared to other stablecoins.