Circle blacklisted a smart contract tied to privacy protocol Zama on Monday, freezing roughly $12.6 million in user funds. The action was first spotted by on-chain investigator ZachXBT, who noted the blacklist hit the Confidential USDC (cUSDC) contract deployed on Ethereum just seven hours after it went live. The contract address was publicly listed in Zama's documentation and visible on blockchain explorers.
How the freeze happened
The blacklist targeted a protocol-level pool rather than individual wallets. That's a notable shift — Circle's March 2026 crackdown hit over 16 hot wallets across various entities, but this time they froze a single contract where user funds are pooled together. ZachXBT said the Zama team appears to have received no prior warning before the cUSDC contract was blacklisted.
Wallet address 0xf7fcc deposited about $12.4 million in USDC into the Zama contract on May 11. That wallet is reportedly tied to Overnight Finance, a project that's been in turmoil. Token holders there allege a possible rug pull, and a governance vote is underway to distribute treasury assets. ZachXBT also shared that Overnight Finance faces a civil case in court, with Patagon Management among the plaintiffs.
The Overnight Finance connection — unconfirmed but suspicious
No direct link between Circle's freeze and the Overnight Finance drama has been confirmed. But the timing is hard to ignore. ZachXBT suggested the freeze may be indirectly tied to the controversy and legal issues surrounding Overnight Finance. Circle hasn't said a word about why it targeted the Zama contract, and the company declined to comment for this piece.
This isn't the first time Circle has moved without explaining. In March, it froze over 16 hot wallets and never publicly gave a rationale. That pattern — acting silently, then staying silent — is starting to worry people building on USDC.
Wider implications for decentralized systems
The Zama blacklist raises a question that's been lurking for a while: if Circle can freeze a protocol-level contract holding pooled user funds, what does that mean for the “decentralized” part of DeFi? The contract itself was transparent — documented, on-chain, no attempt to hide — but that didn't stop the blacklist.
Circle's stablecoin is the backbone of a lot of DeFi. If the issuer can pull the plug on a contract without warning, users bear the risk. No one from Circle has offered an explanation. Until they do, the industry is left guessing whether this was a targeted enforcement action tied to Overnight Finance, or the start of a broader crackdown.
