Circle Froze 16 Business Hot Wallets — Including a Blockchain Bridge Smart Contract
Last updated: March 26, 2026. This post will be updated as the situation develops.
On the evening of March 23, 2026, Circle Internet Financial executed a mass USDC blacklist action against 16 wallet addresses simultaneously. The wallets belonged to operating crypto businesses — casinos, forex brokers, and payment processors — processing thousands of daily transactions. None were sanctioned entities. None were identified as hackers. The freeze was executed in response to a sealed U.S. civil court order, with no advance notice to affected parties.
What made this incident unusual was not just the breadth of the freeze. One of the 16 addresses — listed initially as "unknown" — turned out to be the ckETH Minter Smart Contract operated by the DFINITY Foundation: the bridge infrastructure connecting Ethereum to the Internet Computer Protocol (ICP). Circle had frozen a public, documented protocol contract used by thousands of users who have no connection to the underlying civil case. Every USDC withdrawal from ICP to Ethereum stopped working. AMLBot identified the address and flagged it publicly.
What Happened: A Timeline
March 23, 2026 — Circle blacklists 16 Ethereum addresses in a single batch action via the USDC smart contract's built-in blocklist function. Affected addresses are immediately unable to send or receive USDC. No advance notice is given to any of the affected parties.
March 24, 2026 – On-chain investigator ZachXBT raises the issue publicly on X, asking why Circle would freeze 16 unrelated operational hot wallets for a civil matter when basic on-chain review clearly showed they were processing legitimate business activity. After speaking directly with one of the affected businesses, he confirms the freeze stems from an ongoing U.S. civil case whose details remain sealed. Seven of the 16 addresses appear without identified owners, listed as unknown service hot wallets.
How come Circle froze the USDC balance of 16 unrelated hot wallets late yesterday for a civil case?
— ZachXBT (@zachxbt) March 24, 2026
A basic review of onchain activity makes it obvious they are operational wallets.
You fail to protect users during actual incidents yet respond to a request riddled with errors… pic.twitter.com/lSPCnIA1xK
The affected businesses identified publicly include:
- Rain.gg (
0x87d18ee84e8f4f5709cbf3500179a4c601da12ce) - Clash.gg (
0x9e2a58d257963a276452fff1be94c0eb7e2775cc) - Whale.io (
0x4bd282c083d9ec35aa6c3e0f366d79f12f3a1630) - Goated.com (
0x61f08d119974a3d9915f06765d83fe1aa677e543) - 500 Casino (
0x68416debc20d13e5ef694cdcac9506f4c1a20184) - Finrax (
0x258494a21d9ea90fcbcb9e22bd57c6899de0d995) - Herofx (
0x2704ba2d5d3544e6292d9aca536b6bbbfebd80e9) - Coinsbuy (
0x5f9acf4e85aa7283e0c16dd94cbc942f9d625151,0x22face80f43b857141e9752c3bae8c3309fcdd0f) - Unknown (×7) (
0xfb3a175ce3cb33d9f464a3c5ea0b834dae2aaaf60xb25ea1d493b49a1ded42ac5b1208cc618f9a9b800x090aac31fca0d19f91e30e02ec8217098a3a44460xbfca3e2097baa1eb354e9d915180707dde1027f20x3b848ac300b9e0d260e812b628b87a03d278db950x00e84a0b678cd4584a9a377d334c8100259708730xf9e83020cccbd1a95f0f257a5a9e3d58149762f8)
March 24–25, 2026 — AMLBot identifies the DFINITY bridge address. Among the seven "unknown" addresses is 0xb25eA1D493B49a1DeD42aC5B1208cC618f9A9B80. AMLBot (@AMLBotHQ X) identifies this in a public reply to ZachXBT's thread, tagging Circle and FastCompany. The address is not a business hot wallet — it is the official ckETH Minter Contract operated by the DFINITY Foundation. This contract is the Ethereum-side component of ICP's chain-key token infrastructure. When a user deposits ETH or ERC-20 tokens (including USDC) into it, the equivalent ckETH or ckUSDC is minted on the Internet Computer. It is publicly documented in DFINITY's own support pages, processing transactions on behalf of thousands of ICP users — none of whom have any connection to the civil case that prompted the freeze.
One of the addresses banned by Circle is connected to @dfinity. According to their docs 0xb25ea1d493b49a1ded42ac5b1208cc618f9a9b80 is a helper address that converts ckETH to ETH. https://t.co/X14oybB4ys
— AMLBot (@AMLBotHQ) March 25, 2026
In addition, according to AMLBot's on-chain attribution, at least one of the seven unidentified addresses belongs to a licensed cryptocurrency exchange.
Another banned service is actually a LICENSED exchange. Meaning that Circle just blacklisted a legal entity that went with all regulatory and compliance requirements.
— AMLBot (@AMLBotHQ) March 25, 2026
March 25, 2026 — DFINITY confirms the impact. A thread opens on the Internet Computer Developer Forum. The issue is formally reported:
"The Ethereum mainnet address used by ckBridge for USDC transfers has been blacklisted by Circle. This is preventing all USDC withdrawals from Internet Computer (ICP) to Ethereum from completing successfully."
DFINITY developer gregory-demay confirms: "That's unfortunately correct, Circle blacklisted the minter. We will reach out to Circle to clarify this issue."
Failed withdrawal transactions return the error: Blacklistable: Account is Blacklisted.Users attempting to withdraw ckUSDC from ICP to Ethereum find funds stuck in transit with no automated resolution path. The issue has been active for 32+ hours at the time of this report.
March 26, 2026 — Circle begins partial reversal. Circle unfreezes the Goated.com Wallet (0x61f08d119974a3d9915f06765d83fe1aa677e543), which held 130,966 USDC. Additional wallets are expected to follow. The status of the DFINITY ckETH minter address remains unresolved at time of publication. In follow-up commentary, the plaintiffs' law firm is identified as Willkie Farr. Concerns are raised about the technical competency of the expert witness whose blockchain analysis supported the freeze request. The civil case remains sealed with no basis communicated to the affected businesses.
The DFINITY Minter: Why This Address Is Different
The ckETH Minter Contract (0xb25eA1D493B49a1DeD42aC5B1208cC618f9A9B80) is publicly documented in DFINITY's support materials as the address that handles ETH and USDC bridging for all ICP users. It is not a wallet controlled by a single business entity — it is shared protocol infrastructure.
Freezing it does not restrict one company's operations. It cuts off USDC bridging for the entire ICP ecosystem.
The likely mechanism by which this address ended up in the freeze request: transaction graph cluster analysis. Any business depositing USDC through ICP would produce on-chain connections to this minter address — including businesses entirely unconnected to the civil case. If the forensics submission used automated cluster detection without verifying the nature of each address in the graph, a protocol-level smart contract would be indistinguishable from a business wallet in the output.
This is the specific technical failure point worth documenting: cluster analysis that flags shared infrastructure as a linked wallet is a known limitation of automated blockchain forensics. It requires manual verification to catch. That step apparently did not happen here — either at the forensics firm, at Circle, or in the court's review.
The Legal Framework
The freeze traces to a sealed civil lawsuit in a New York federal court. Under the GENIUS Act (signed July 18, 2025), stablecoin issuers in the United States are required to possess the capability to freeze tokens upon receipt of a lawful court order.
AMLBot's Data in the Broader Coverage
Separate from the real-time identification of the DFINITY bridge address, AMLBot's historical research on stablecoin freeze activity has been cited across coverage of this incident.
AMLBot maintains a public Dune Analytics Dashboard tracking USDC and USDT blacklist activity. According to that data, as of early 2026:
- Circle has blacklisted approximately 372 addresses holding a combined total of roughly $109 million in USDC since the token launched
- Tether has blacklisted more than 7,268 addresses across Ethereum and Tron, freezing approximately $3.29 billion in USDT during 2023–2025 alone
- More than 2,800 of Tether's freeze actions were coordinated with U.S. law enforcement agencies
AMLBot's December 2025 report "Stablecoin Freezes 2023–2025" provides the full methodology and dataset.
Where Сan I Verify the On-Chain Data?
- AMLBot Dune Dashboard (USDC/USDT Freeze Tracking):
- DFINITY Developer Forum Thread
- Circle Blacklist Transaction (ckETH Minter):
0xf4080ba2c142fcf27c93ec545a7316ced4de6fd579fa741ac75569b4c8d3d186 - Failed Withdrawal Example:
0x85f621a566d58e7392d4f390455ac0886277e2a0ea99beb584d027d003cc3e7a
Follow AMLBot:
🔗 Website
🔗 Telegram
🔗 Support Team
🔗 LinkedIn
FAQ
Why did Circle Freeze the DFINITY ckETH Minter Smart Contract?
Circle blacklisted address 0xb25eA1D493B49a1DeD42aC5B1208cC618f9A9B80 as part of a batch freeze covering 16 addresses linked to a sealed U.S. civil case. The address appeared in the original freeze list as "unknown." The ckETH minter is public, shared infrastructure — not a wallet controlled by any of the named defendants. It was most likely included via automated transaction graph cluster analysis that flagged it due to on-chain connections with businesses that were targets of the freeze. Manual verification, which would have identified the address as a protocol-level smart contract, apparently did not occur.
What is the ckETH Minter Address 0xb25eA1D493B49a1DeD42aC5B1208cC618f9A9B80 and Why Was it Blacklisted?
It is the official Ethereum-side smart contract operated by the DFINITY Foundation for bridging ETH and ERC-20 tokens (including USDC) to the Internet Computer Protocol (ICP). Any user depositing USDC through ICP transacts through this address. It is publicly documented in DFINITY's own support materials. It was blacklisted by Circle on March 23, 2026, as part of a civil court freeze order — despite having no ownership or operational connection to the businesses named in the case.
Which Businesses had their USDC Frozen in the March 2026 Circle Civil Case?
The publicly identified businesses are Rain.gg, Clash.gg, Whale.io, Goated.com, 500 Casino, Finrax, Herofx, and Coinsbuy (two addresses). Seven additional addresses — including the DFINITY ckETH minter — were initially listed as unknown. All 16 addresses were frozen on March 23, 2026. The underlying civil case remains sealed, and the defendants have not been publicly named.
Are ICP-to-Ethereum USDC Withdrawals Working after the Circle Freeze?
As of March 26, 2026 — no. The ckETH minter address remains on Circle's blacklist. Any ckUSDC withdrawal from ICP to Ethereum fails with the error Blacklistable: Account is Blacklisted. DFINITY has confirmed the issue and stated it is in contact with Circle. There is no automated resolution path for funds currently stuck in transit.
Which Wallets have been Unfrozen by Circle after the March 2026 Incident?
As of March 26, 2026, Circle has unfrozen one wallet: Goated.com (0x61f08d119974a3d9915f06765d83fe1aa677e543), which held 130,966 USDC at the time of restoration. The remaining 15 addresses, including the DFINITY ckETH minter, remain frozen. Circle has issued no public statement on the scope or timeline of further reversals.
What Law Firm filed the Freeze Request Behind the March 2026 Circle USDC Freeze?
The plaintiffs' law firm has been identified as Willkie Farr. The presiding judge, the forensics firm that provided the blockchain analysis supporting the freeze request, and the identity of the plaintiff remain undisclosed due to the sealed nature of the case.
Can DFINITY Recover Access to the frozen ckETH Minter Address?
DFINITY has confirmed it is in contact with Circle to resolve the issue. However, there is no established appeal or reversal process for addresses frozen under civil court orders in USDC's blacklist mechanism. Resolution depends entirely on Circle acting voluntarily or receiving a court instruction to unfreeze the address. The timeline is unknown.