ZachXBT criticizes Circle for inaction on the use of USDC by DPRK developers
According to the analyst, North Korean blockchain developers are actively using stablecoin to make payments
01.07.2025 - 10:05
384
4 min
0
What’s new? Anonymous blockchain analyst ZachXBT, known for his investigations into hacks and fraud in the cryptocurrency industry, has claimed that the popularity of the USDC stablecoin from issuer Circle among North Korean developers is growing. He stated that IT professionals from the sanctioned DPRK are using the asset to make payments, with transactions with it reaching tens of millions of dollars recently alone.
What else is known? ZachXBT accused Circle of taking no action to monitor and freeze criminal funds, while claiming to comply with legal requirements. The analyst left such a comment under the news that Circle has applied for a banking license in the United States.
In the discussion below the post, one user, citing data from blockchain analytics platform Dune, noted that Circle has frozen nearly $13,4 million worth of USDC related to illicit activities in 2024 alone. ZachXBT, in turn, emphasized that 27% of that amount was identified and frozen thanks to his investigations.
North Korean hackers hacked the creator of the Pepe meme. How it happened
The attackers released an unlimited number of Replicandy, Peplicator, Hedz, and Zogz NFT game projects
Another user asked whether, in order to secure their funds, they should use the recently launched RLUSD stablecoin from fintech company Ripple, which also issues the XRP token, instead of USDC. ZachXBT responded that he trusts stablecoin issuers like Circle, Paxos, and Tether much more than Ripple.
He explained: although RLUSD has collateral and is issued by a US company, the asset has no organic users, and the company is actively pursuing paid partnerships to create the appearance of its increasing mass adoption. The analyst later deleted a tweet with this statement.
In April, Google experts told about threats from DPRK developers: using fake documents, they get employed by crypto firms and gain access to internal systems to steal funds.
Later, the reverse strategy also became known. For example, the Lazarus hacker group, which is associated with the financing of the DPRK’s weapons program, has launched fake crypto firms in the United States. These firms publish advertisements for hiring employees and distribute malware during online interviews.
In May, the US Treasury Department imposed sanctions against the Cambodian company Huione Group for its ties to DPRK hackers. The company laundered at least $37 million related to their hacks.
In June, the US Justice Department filed a lawsuit to seize $7,74 million in blockchain developer proceeds from the DPRK, which were frozen as a result of the 2023 investigation. It was also about North Korean developers getting jobs in the US to circumvent sanctions and accumulating millions of dollars in cryptocurrency for their government.
Useful material?
Incidents
Developers warned of potential risks to bridges across the ecosystem and asked exchanges for assistance.
Jun 22, 2026
Incidents
The defendant helped move funds stolen through investment scams and earned at least $4 million for his role in the operation.
Jun 10, 2026
Incidents
The company is linking the incident to a compromised private key on a service wallet, rather than a smart contract exploit
May 22, 2026
Incidents
Following the incident, the project temporarily halted trading operations and node activity.
May 15, 2026
Incidents
The user spent weeks unsuccessfully trying to guess the password until Claude helped find an old wallet backup file
May 14, 2026
Crypto regulations
Authorities are introducing mandatory registration for companies handling cross-border crypto transactions
May 8, 2026


Telegram
Twitter