Approximately $12.6 million worth of confidential USDC (cUSDC) held within the privacy protocol Zama has reportedly been frozen after Circle blacklisted the associated contract address. The information was first disclosed by blockchain investigator ZachXBT in late May 2026.

The freeze affected nearly all funds stored in the cUSDC contract on the Ethereum network. The incident has drawn significant attention from the crypto community, as it involves funds allegedly linked to the Overnight Finance hack and raises questions about the asset-freezing capabilities of centralized stablecoins such as USDC.

Timeline of the cUSDC Freeze

According to ZachXBT, Circle likely added Zama’s cUSDC contract address to its blacklist, preventing approximately $12.6 million in user funds from being transferred.

On-chain analysis indicates that the contract address recently participated in an Overnight Finance governance vote concerning treasury allocation. This finding sparked speculation that the frozen funds may be connected to ongoing legal proceedings involving Overnight Finance.

ZachXBT also noted that some users had previously accused the project team of conducting a rug pull. However, there is currently no public evidence suggesting that the Zama team was involved in such activities.

Based on shared information, more than 99% of the funds held in the cUSDC contract originated from a single address previously linked to the Overnight Finance exploit. The value of those funds is estimated at approximately $12.5 million.

Possible Misunderstanding in Legal Proceedings

ZachXBT highlighted that one of the plaintiffs in the civil lawsuit against Overnight Finance is Patagon Management, an entity known for pursuing DAO takeovers and asset recovery efforts from troubled protocols.

According to him, there is a possibility that the plaintiff misinterpreted the relationship between the frozen address and Zama’s contract when presenting information to the court. He also stated that the Zama team appeared not to have received prior notice before the freeze was executed.

Meanwhile, Zama founder Rand said that an internal investigation had identified the root cause of the incident and emphasized that it was unrelated to either the Zama protocol or the company’s privacy technology.

Rand explained that approximately $12.5 million USDC was deposited into the protocol by an address connected to the Overnight Finance exploit. At the time of the deposit, the address had not been sanctioned and was not flagged as high-risk by Know Your Transaction (KYT) systems, allowing the funds to enter the protocol without restrictions.

“The root cause has been identified and is unrelated to either the privacy technology or the Zama protocol,” Rand stated.

Because the majority of liquidity within the contract originated from that address, the court subsequently ordered the freezing of the entire wrapped cUSDC contract to prevent potential movement of funds while legal proceedings continue.

Implications for Privacy Protocols and Stablecoins

The case once again highlights a key characteristic of centralized stablecoins such as USDC: issuers can freeze assets in response to legal orders or compliance requirements.

For the blockchain privacy ecosystem, the incident demonstrates how assets deposited into a privacy protocol can still be affected by actions taken at the underlying asset level, even when balances and transactions are shielded through privacy mechanisms.

The situation also underscores the challenges faced by DeFi protocols when accepting funds that appear legitimate at the time of deposit. Changes in legal status or new investigations that emerge later can create consequences for all users interacting with the same contract.

Conclusion

The freezing of approximately $12.6 million in cUSDC within Zama is one of the latest examples of the complex relationship between privacy protocols, centralized stablecoins, and legal enforcement in the crypto industry.

Although Zama maintains that the incident was not caused by any flaw in its technology or infrastructure, the case highlights how compliance risks and the provenance of funds remain critical considerations in DeFi. As investigations and legal proceedings involving Overnight Finance continue, the crypto community will be closely watching the broader implications for privacy-focused protocols and stablecoin usage.