Should Circle be the Frozone of DeFi?

The Sinaloa drug cartel was once depositing so much cash with HSBC they had boxes specially made to fit the precise dimensions of the teller windows at the bank’s Mexico branches. From 2006 to 2010 the boxes — stuffed full of $100 bills — helped the cartel launder at least $881 million through HSBC alone.

In 2012, the Department of Justice cited those bespoke boxes as evidence that HSBC should have recognized it was laundering money for drug traffickers.

(Another clue: in 2007, HSBC Mexico shipped over $7 billion in physical cash to the US.)

When the DOJ settled a similar money-laundering case against Wachovia in 2010, prosecutors emphasized that funds laundered through the bank had been used to purchase airplanes the cartel filled with shipments of cocaine. Prosecutors even quantified the deliveries: “more than 20,000 kilograms of cocaine were seized from these airplanes,” they wrote.

The cartel presumably did not mark its Wachovia wire instructions “for transport of cocaine.” But by including these details, prosecutors were making a point: banks are expected to proactively prevent criminals from moving their money around.

Should stablecoin issuers be expected to do the same?

A class action lawsuit filed against Circle says they already are.

The suit accuses Circle of “aiding and abetting” North Korean hackers who recently exploited the Drift protocol for $280 million of crypto.

Most of that was converted to USDC — where they remained for eight full hours — and then moved over Circle’s bridge to safety on the Ethereum blockchain.

The lawsuit alleges that, "by law, Circle was not free to look the other way while knowing it was enabling this misappropriation."

Circle, they say, had a “duty” to freeze the funds: “Circle breached its duty to Plaintiff and other members of the class when, among other things, it did not freeze the assets (in USDC at the time) and permitted the Attackers’ use of CCTP to bridge hundreds of millions of dollars in stolen cryptocurrency.”

Its failure to act proactively means Circle “substantially assisted the attackers,” it adds.

The blacklist function that allows Circle to freeze USDC is not very cypherpunk, but a lot of crypto people agree that the company should use it more often. ZachXBT, for example, has been documenting every crypto exploit where he thinks Circle was negligent in failing to intervene.

But turning the ability to freeze funds into a legal obligation to do so will be a difficult argument to win in court.

Technology reporter Carter Pape writes that the class-action lawsuit is “proposing a new legal theory”: namely, that a stablecoin issuer's ability to freeze tokens creates “an obligation to freeze customer funds in real time” (an obligation which Pape says no traditional bank has).

In other words, Circle has given itself great power, and with it comes great responsibility. 

The lawsuit Circle now faces is effectively asking a federal judge to decide what responsibility issuers have when their funds are involved in a suspected hack or exploit.

But Circle CEO Jeremy Allaire does not want to be the Frozone of DeFi. Allowing a private company to make these decisions would create “a moral quandary,” he said after the Drift hack.

Allaire says Circle could only proactively exercise its freezing power if stablecoin issuers were granted a legal safe harbor to do so (protecting them from liability should a suspected hack later turn out to be just someone moving money around).

In the meantime, he believes Circle has a “very, very clear performance obligation under the law” — they freeze USDC when law enforcement tells them to.

Professor Omid Malekan agrees: “If Circle and other stablecoin issuers implement arbitrary freeze/seize functions beyond what the law requires,” he wrote on X, “then not only is code not law, but also law is not law.”

An executive inside a corporation should not be making decisions for all of DeFi, Malekan adds.

Professor Austin Campbell disagrees: “Circle created significantly more liability for themselves by not freezing than they [would have] by freezing,” he says of the Drift exploit. “There is a safe harbor in BSA for freezes. There is no safe harbor for failing to act for known criminal activity.”

He adds that a bank seeing similarly suspicious activity would have proactively frozen the suspect accounts — so he thinks Circle should have, too.

If so, this will be easier in crypto. There’s no need to infer criminality from boxes custom made to fit teller windows.

Onchain, money moves in transparent blocks, and stablecoin issuers have granted themselves the power to stop it.

The courts will decide if they also have the responsibility to use it.

— Byron Gilliam