Circle Freezes $12.6M in Zama’s USDC After Hack

A federal judge on May 30 ordered Circle to freeze about $12.6 million held in Zama’s confidential USDC contract after funds from the Overnight Finance hack were routed into Zama’s cUSDC wrapper. The order directed Circle to blacklist the Ethereum contract that issues the private USDC token.

Zama reported that a wallet linked to the Overnight Finance exploit transferred more than $12.5 million in USDC into its cUSDC wrapper. Because the wrapper had almost no prior activity and more than 99% of its balance came from that single deposit, prosecutors asked the court to restrain the entire contract to stop the hacker from moving the funds.

The freeze was carried out by blacklisting the specific Ethereum contract that created Zama’s private USDC token, preventing addresses using that contract from transacting with balances governed by Circle’s controls. Circle has stated it freezes USDC only when legally required, not automatically during hacks or at third-party requests; the court order provided the legal basis for this action.

Zama co-founder Rand Hindi wrote that the confidential contract had been “caught in a crossfire of another case.” He added the order targeted the hacker’s assets, not Zama’s privacy technology, and that the company paused cUSDC, cUSDT and cWETH while preparing a post-mortem and assisting investigators in identifying related wallets.

The pseudonymous blockchain investigator ZachXBT called the decision “a dramatic twist” and referenced 15 prior USDC thefts he tracked that totaled about $420 million, in which Circle did not freeze tokens.

Zama said it will cooperate with law enforcement and restore services once legal and forensic reviews are complete. Authorities and affected parties continue to investigate the Overnight Finance exploit and the chain of transactions that led to the deposit into Zama’s wrapper.