ZachXBT Says Circle's New Blockchain Is Built for Laundering

Two days before Circle switches on its new blockchain, one of crypto's most-followed investigators is telling people not to trust it.

Blockchain sleuth ZachXBT has claimed, in a post attributed to his X account, that Arc — Circle's USDC-native Layer-1 network — exists mainly to move USDC through the chain's confidential transaction feature without anyone noticing. Framed generously, it's a warning about a design flaw. Framed the way ZachXBT apparently framed it, it's an accusation that the network's privacy tooling is a laundering vehicle with better branding.

A caveat worth stating plainly: we could not independently verify the specific post being cited. X blocks automated access to individual tweets, and no other outlet appears to have reported on this particular claim yet. What we can verify is the pattern it fits into. ZachXBT has spent most of 2026 building a public case that Circle talks tougher on compliance than it acts, and that record is worth laying out before anyone decides how much weight the new claim deserves.

A Launch Timed Awkwardly

Arc goes live on September 16, one day after a Senate cloture vote on the CLARITY Act. It launches with eleven institutional validators running alongside Circle itself — BlackRock, DTCC, Visa, Mastercard, ICE, Galaxy, Global Payments, MoneyGram, SBI Group, Standard Chartered and Sumitomo. That's not a validator set so much as a client list. Circle is selling Arc to banks and asset managers who were never going to run a node next to an anonymous stranger, and the roster is the pitch.

The feature under fire is "confidential transfers," part of a broader privacy roadmap Circle calls Arc Privacy. It hides the dollar amount of a transaction while leaving sender and receiver addresses visible on-chain. Circle's fix for the obvious compliance gap is "view keys" — a mechanism letting an institution grant an auditor or regulator read access to a hidden amount without exposing it publicly. Privacy from competitors, transparency for anyone with the right key. That's the pitch, anyway.

ZachXBT Has Heard This Pitch Before

He wasn't buying it the first time Circle raised it, either. When Circle previewed reversible-transaction and privacy features for Arc late last year, ZachXBT pushed back publicly, arguing that Circle "does not even proactively freeze addresses tied to North Korean or exploiter groups" — and asking, essentially, whether the new tooling was security or just looked like it to regulators.

That line didn't come out of nowhere. In April, ZachXBT published what he titled "The Circle USDC Files," a thread alleging more than $420 million in compliance failures across 15 cases since 2022. The centerpiece: the Drift Protocol exploit, in which an attacker moved roughly $232 million in USDC from Solana to Ethereum using Circle's own CCTP bridge, across more than 100 transactions, over six straight hours. Circle froze nothing during that window. Elliptic later flagged indicators pointing to North Korea. ZachXBT also cited the Cetus hack, where Circle blacklisted an address a full month after the stolen USDC had already been swapped into ETH, and drew an unflattering comparison to Tether, which froze funds tied to the February 2025 Bybit hack within hours.

Circle disputes none of the underlying transactions, and its own terms give it broad freeze authority — it can block addresses network-wide under U.S. or French legal orders, or whenever it decides the security risk is high enough. It has used that power aggressively at times; in March, it froze USDC balances across 16 unrelated business hot wallets caught up in a sealed civil matter. The contrast ZachXBT keeps drawing is exactly that one: fast and broad against legitimate businesses in a sealed dispute, slow or absent against wallets actively moving stolen funds in public.

Why the Timing Matters

Layer a confidentiality feature on top of that record and the concern more or less writes itself. If Circle already moves slowly to freeze funds it can plainly see, what happens once transaction amounts are shielded from public view by default? Circle's position is that confidential transfers don't touch its own visibility or its freeze powers — the shielding applies to the public ledger, not to Circle, and not to whoever's holding a view key. Whether that distinction holds once Arc is carrying real institutional volume instead of testnet traffic is, at this point, untested. Circle also hasn't said how confidential transfers will interact with sanctions screening or with CCTP, the same bridge that carried the Drift Protocol funds out of reach in April.

None of that confirms the specific claim ZachXBT is reported to have made. It confirms only that the claim isn't coming from nowhere — it's coming from someone with a receipts-heavy track record of catching Circle on the wrong side of exactly this question. Circle had not responded to the laundering claim as of publication.