Zama, the privacy encryption company, has lifted the freeze on its confidential USDC contract (cUSDC) that was frozen as of May 31. Previously, Circle carried out a blacklist operation overnight against the cUSDC contract address pursuant to a federal court order, freezing a USDC pool worth $12.6 million. The trigger was a civil dispute between Overnight Finance’s founder and OVN token holders.
Freeze Trigger Mechanism: A Single Disputed Depositor Locks the Entire Contract Pool
Circle maintains a built-in blacklist in its USDC smart contract. Authorized accounts can add an Ethereum address to the list, and all USDC held by addresses on the list are frozen. cUSDC is a pooled-contract architecture, with all users’ underlying USDC stored at the same Ethereum contract address. Circle’s blacklist action locked the entire contract address rather than targeting only a specific depositor, causing legitimate users with no relation to the Overnight Finance dispute to simultaneously lose access to their funds.
Zama CEO Rand Hindi publicly confirmed during the incident that his team received no notification before Circle executed the blacklist, and said the agreement “was pulled into the conflict.” Zama then announced a suspension of issuance for three wrapped coins: cUSDC, cUSDT, and cWETH, while its legal team began engaging with U.S. attorneys.
Zama Confirms June Go-Live, Introducing an Account-Level Freeze Mechanism
Zama released its plan for what happens next after the freeze is lifted. The cUSDC product is scheduled to正式 launch in June 2026, and will be protected by $5 million worth of USDC from the company treasury. Zama also released a compliance roadmap, including establishing a compliance committee, integrating a privacy-protection-based KYT system, and introducing an automated control mechanism for mirrored underlying assets.
The final item is a key architectural change: if Circle freezes a USDC address, the corresponding cUSDC account address will be frozen in sync. This shifts compliance enforcement to the account level rather than using the entire contract level as the means, with the goal of preventing a future single disputed depositor from triggering a full contract lock again.
Circle Blacklist Records Compared: Drift Event $420 Million Gap
On-chain investigator ZachXBT documented cases involving Circle freeze actions since 2022. In 15 incidents, more than $420 million in stolen funds were not frozen. In these events, Circle either delayed action or failed to take measures.
In the April 1 Drift Protocol incident, the attacker used Circle’s own CCTP infrastructure to complete over a hundred transactions within six hours, transferring about $232 million in USDC from Solana to Ethereum. Security firm PeckShield and Arkham publicly marked the activity while it was ongoing, but Circle took no freezing action. Circle’s official position was that, without receiving a court order, sanctions notice, or enforcement request, it would not unilaterally freeze assets.
GENIUS Bill Status: Under Senate Review, No Protection Rules Covering Hybrid-Contract Freezes
The GENIUS Bill currently under consideration in the U.S. Senate formally establishes compliance obligations for stablecoin issuers. However, based on the publicly released draft text, the bill does not include provisions governing mechanisms for freeze orders targeting shared contract addresses, nor does it establish protection terms for third-party users affected by orders targeting specific depositors.
FAQ
How does Zama’s cUSDC work, and how is it different from a mixer?
cUSDC is a privacy-preserving USDC wrap built on the ERC-7984 standard. After users deposit USDC, they receive cUSDC. Balances and transaction amounts are encrypted on-chain via Fully Homomorphic Encryption (FHE), so on-chain observers cannot determine an individual’s holdings or transfer amounts. However, the wallet addresses of the sender and receiver remain publicly visible. Zama has explicitly stated that cUSDC is not a mixer, but rather a privacy computation infrastructure.
What structural implications does this freeze have for other DeFi protocols holding USDC?
Any DeFi protocol that stores USDC in a shared contract address faces the same legal risk: if a court order targets a contract address rather than an individual wallet, a freeze order against a single depositor will lock the funds of all users who share that contract. This applies to lending agreements, liquidity pools, yield aggregators, and privacy layers.
Why did Circle handle the Zama event differently from the Drift event?
Circle carried out the Zama freeze operation after receiving a federal court-issued temporary restraining order, aligning with its official policy of freezing only upon receipt of court orders, sanctions notices, or enforcement requests. In the Drift incident, no equivalent legal authorization documents existed, so Circle did not take action. The different standards for handling the two scenarios have prompted ongoing industry doubts about consistency in freeze mechanisms.
