Circle Delayed Freezing USDC Addresses Linked to Bybit Exchange Hack. Bybit Managed to Refill Its ETH Losses but Still Seeks Its Lost Funds

On-chain investigator ZachXBT noted Circle had delayed the freezing of USDC addresses linked to the Bybit exchange hack. The funds can still move, despite Circle's ability to freeze addresses and recoup losses.

On-chain investigator ZachXBT has pointed out that USDC is not cooperating quickly enough with the recovery of funds from the Bybit exchange hack. Some of the funds are held in USDC, which can be frozen by the issuer.

The current addresses with funds from the hack are still free to transact, making it possible for the hackers to launder the funds. One of the concerns of ZachXBT is to return as much of the stolen funds as possible. Bybit already managed to refill its ETH losses but still seeks its lost funds on principle. The investigator responded to Jeremy Allaire, co-founder of Circle, aiming to bring attention to the project’s responsibility for controlling losses.

The involvement of USDC in the Bybit hack arrives at a time when Circle aims to evolve its stablecoin into a fully legalized payment tool. USDC is the favored stablecoin in Europe and was recently recognized by the Dubai Financial Service Authority. The USDC stablecoin grew by 3.1B tokens in the past three months, mostly due to issuing on Solana.

Zoom in: USDC addresses linked to hacker activity

The USDC addresses identified by ZachXBT hold just 115K tokens, a small sum compared to the scale of the $1.5B hack. Time is still of the essence in recovering funds, and even a sum of $115K may be relevant in other types of hacks.

The potential to freeze funds from USDC was at first seen as a risk, but the stablecoin has the ability to stop bad actors and restore tokens to their owners. So far, USDC has banned an estimated 268 addresses, with no standard on targeting bad actors and reacting based on blockchain data.

ZachXBT tracked the addresses based on the original transfers of ETH. USDC was chosen as a secondary asset and could be frozen and re-issued. Despite the threat of freezing, bad actors still use the two leading stablecoins, aiming to act fast before the funds are intercepted.

Now 0xda2e has 338K USDC after receiving another 222.9K USDC after my post so here’s the tracing explained step by step probably showing its funds from the Bybit hack:

1). 0xda12 received 204.91 ETH from 0xe41B 31 hours ago in the following transaction: https://t.co/Q5v7G8132v

2). 0xe41B deposited 385 ETH to Bybit at 08:00 AM today. This is the same address that paid the Bybit fee in the liquidation transaction.

3). 0xda12 then swapped 115K USDC for 199 ETH on CHANGENOW in the following transaction: https://t.co/9yB5mG2z9I

4). 0xda12 then sent 199 ETH to 0xe41B in the following transaction: https://t.co/79M3mKqOaI

5). 0xe41B then deposited the 199 ETH to Bybit in the following transaction: https://t.co/R7L7QzR89B

6). Bybit credited the 199 ETH to Bybit user ID 2377101 in the following transaction: https://t.co/y8P7E9mP7E

7). The user ID 2377101 then withdrew 199 ETH in transaction 14285848 to an address that begins with 0x99f in the following transaction: https://t.co/M75Nq6rJBi

8). The address 0x99f then sent the 199 ETH to 0xda12 in the following transaction: https://t.co/3qG7jO7I8v

9). 0xda12 is the same address that sent the 115K USDC to the DeFiChain address.

This is a potential chain of events that could have occurred, and it is possible that other events took place. However, this analysis provides a plausible account of how the USDC funds could have been moved and how they are linked to the Bybit hack.

In the past six years since the launch of USDC, crypto users remained skeptical of the freeze function inherent to the USDC token. In theory, Circle could choose to freeze any address for any reason. This time, however, the token issuer has not taken note of the small-scale funds leak.

Circle is working at scale, often issuing $250M mints daily, and has paid little attention to smaller holdings. Circle has still assisted