Circle Freezes $12.6M USDC from Zama Privacy Protocol Without Warning

On May 30, Circle blocked $12.6 million in USDC from the smart contract of privacy protocol Zama. On-chain sleuth ZachXBT was the first to report the freeze. According to him, the Zama team received no advance notice. Circle did not respond to CoinTelegraph's request for comment.

What Is Zama and How Does Confidential USDC Work?

Zama is a French company that builds libraries based on FHE (fully homomorphic encryption). The technology allows computations on encrypted data without exposing it. A smart contract can verify a transaction without revealing the amount or participant addresses. On a standard blockchain, all fund flows are visible. In Zama they are not.

Confidential USDC is a wrapper over the standard token. A user deposits USDC into the Zama contract and receives an encrypted version for use in DeFi protocols. This is the smart contract that ended up frozen.

Overnight Finance is a DeFi yield optimization protocol that automatically distributes user funds across strategies to maximize returns. On May 11, 2026, its wallets transferred $12.4 million into the Zama smart contract. Nineteen days later, Circle blocked the addresses without warning.

How Did ZachXBT Find the Freeze?

The on-chain sleuth spotted the status change through public blockchain records. The Zama smart contract is publicly documented in the protocol's technical documentation and labeled in blockchain explorers. Circle could identify these addresses without difficulty.

No official reason for the freeze has been given. ZachXBT's theory: Circle acted on an order in a US civil case unrelated to either Zama or Overnight Finance. A similar case occurred in March 2026. ZachXBT documented the freezing of 16 wallets belonging to online casinos and legitimate exchanges. The official explanation was court orders, but the wallets, according to the investigator, had no connection to the plaintiffs in those cases.

"From my understanding, the Zama team does not appear to have been notified of the Circle freeze prior."

- ZachXBT, on-chain investigator, post on X, May 30, 2026

The Statistics That Do Not Favor Circle

While Zama addresses remain frozen, on-chain data tracks a different list, where Circle did not act against real crimes:

• 15 hacks between 2022 and 2026 after which Circle did not freeze stolen USDC. The combined total exceeded $420 million
• Drift Protocol, April 2026: hackers stole $232 million via CCTP. Circle had a six-hour window to block the funds and did not act
• After the Drift incident, affected users filed a class action lawsuit against Circle for inaction during the CCTP transfer
• March 2026: erroneous freezing of 16 legitimate addresses through court orders with no direct link between those addresses and the underlying cases

What Does This Mean for USDC Holders in DeFi?

USDC does not pretend to be a decentralized asset. Circle's right to freeze addresses is written directly into the terms of issuance. Users accept this when they deposit USDC into any protocol.

The Zama case raises a specific question. Can a freeze hit an address that is not the target of a court order, simply because funds ended up in the wrong smart contract at the wrong time? It appears so. The same risk applies to any DeFi protocol holding USDC in liquidity pools or smart contracts. A freeze can arrive through the actions of other participants in the same contract, not from anything the protocol itself did.

Those for whom issuer-level regulatory risk is a concern often compare USDC to USDT. Tether also acts on law enforcement requests and freezes addresses, but mostly through direct requests rather than civil court orders where the link to specific addresses is unclear.

A Precedent That Matters More Than the Amount

Zama is building infrastructure for confidential blockchain transactions. FHE has the potential to change how DeFi handles sensitive data. But even if the technology is sound, the regulatory risk from the issuer of the underlying asset sits outside its control.

$12.6 million is not a large sum for the market, but the question it raises is significant. A privacy protocol can be stopped not by a broken contract, but by a court order in a case it never knew about. That is already a question for the entire architecture of USDC in DeFi.