USDC (USDC)

155 teams shipped on Arc at ETHGlobal HackMoney.

What emerged from the builder community:
→ AI agents managing treasuries autonomously
→ SMS-based DeFi with no app required
→ Self-paying corporate treasuries deploying idle capital
→ Construction escrow without lawyers or wire delays

Developers are using Arc as a liquidity hub to coordinate multichain USDC flows without managing the underlying complexity.

Read the full hackathon review: https://t.co/onkbY30fLT

I don't want to harp on it, but

1) Immutability isn't always desirable unless it is truly robust (whatever that means).

2) I kind of think that the modular approach to lending is bearish. The SS isn't a valid excuse because the outcome for the user remains the same: losses.

Whenever these exploits, losses, depegs, or whatever happen, a deeper study often reveals other parts of the system failing, and the problems cascade downward. Maybe Aave was right in a sense that you want to be opinionated and control the full stack.

I don't know much about this, but my simple view is to keep things isolated and straightforward. Obvious high risks are better than hidden "low" risks. I can build tools and manage positioning size with the former, but the latter lowers your guard and leads to deeper shit.

ZachXBT directly targets Circle's compliance.
Whose centralization is Circle's USDC for?

Yesterday, a major exploit occurred on the Solana chain's Drift protocol.

Putting Drift aside, Circle failed to urgently respond with its USDC freezing capability, amplifying the damage.

Where is the US compliance user protection value that Circle boasts?

Since 2022, Circle has not properly used its freeze and blacklist functions in more than 15 major attack incidents.

Key case summary
April 2026 Drift Protocol hack ($280M)
Over 232M USDC moved through the Solana → Ethereum CCTP bridge more than 100 times within 6 hours
Although identified as a DPRK‑linked attacker, Circle did not freeze a single transaction.

January 2026 SwapNet exploit ($16M)
3M USDC left unattended for 2 days
Did not comply with freeze requests from law enforcement and private experts → Funds moved shortly before a New York court order.

May 2025 Cetus Protocol ($223M)
61M USDC bridged over 1.5 hours
Blacklisted only a month after the request (after it had already been converted to ETH).

October 2022 Mango Markets ($110M)
Direct transfer to Circle’s deposit address then withdrawn to Ethereum → No freeze at all.

August 2022 Nomad Bridge ($190M)
45M USDC left untouched for 30–45 minutes → No blacklist.

Other major cases (brief)
July 2025 GMX hack ($40M) → Left unattended for over 2 hours.

February 2025 Bybit hack (DPRK, $1.5B) → Responded 24 hours later than Tether.

October 2024 Radiant Capital (Lazarus Group, $58M) → Several addresses left idle for hours.

December 2023 Ledger supply‑chain attack → Over 3 hours left idle (Tether’s USDT was frozen immediately).

September 2023 Remitano ($8.5M),
November 2022