ZachXBT, a prominent on-chain investigator, has recently criticized USDC issuer Circle, labeling the company “greedy” and “indifferent” to the cryptocurrency community’s security concerns.
His criticism is primarily directed at Circle’s delayed actions in blacklisting stolen funds linked to North Korea’s notorious Lazarus Group. The delay, he argues, has allowed significant sums to be laundered through Circle’s network, further compromising the integrity of the ecosystem.
Circle’s response to Lazarus group exploits under scrutiny
The Lazarus Group, a hacking collective associated with the North Korean government, has been involved in numerous high-profile cybercrimes, including the Sony Pictures hack in 2014 and the $81 million Bangladesh Bank heist in 2016. Recently, they have shifted their focus towards cryptocurrency, executing a series of devastating hacks between August 2020 and October 2023. Despite the severity of these breaches, ZachXBT claims that Circle took 4.5 months longer than other firms, like Tether and Paxos, to block the stolen funds linked to these attacks.
The delay in action has raised concerns within the crypto community, particularly given the scale of the Lazarus Group’s operations. Since 2017, the group is believed to have stolen between $3 billion and $4.1 billion in cryptocurrency, much of which has been laundered through services like Tornado Cash and P2P platforms such as Paxful and Noones.
Lazarus Group’s Crypto crime tactics
The Lazarus Group’s strategy involves hacking into cryptocurrency exchanges and other platforms, stealing significant sums of digital assets. These stolen funds are often moved through mixers like Tornado Cash to obfuscate their origins before being laundered into fiat currency via P2P exchanges. This pattern was evident in several incidents, including CoinBerry, Unibright, and CoinMetro theft in 2020. Funds from these hacks were traced to various addresses, where they were mixed and later withdrawn in smaller amounts to avoid detection.
ZachXBT highlighted the inefficiencies in Circle’s response, arguing that the company’s inaction allowed Lazarus to continue its activities without interference. By the time Circle took steps to blacklist the funds, much of the stolen assets had already been laundered, undermining efforts to secure the ecosystem.
Impact of circle’s delayed actions on the Crypto Community
The criticisms against Circle extend beyond its delayed response. ZachXBT accused the company of prioritizing profit over security, suggesting that Circle’s reluctance to act swiftly was motivated by a desire to continue earning transaction fees, even as stolen funds flowed through its network. This has led to widespread discontent within the community, with many echoing ZachXBT’s concerns about the potential risks posed by such negligence.
In November 2023, Tether eventually stepped in, blacklisting $374,000 in USDT linked to the Lazarus Group. However, this response was seen as too late for many. The damage had already been done, with millions of dollars laundered through platforms like Paxful and Noones, much of it passing through Circle’s network before any meaningful action was taken.
While Circle has yet to respond to these allegations, the controversy highlights the challenges faced by the cryptocurrency industry in balancing security and profitability. The incident reminds us of the importance of timely action in preventing the misuse of digital assets, particularly in the face of increasingly sophisticated cyber threats.