Consider a hypothetical. An investor opens a wallet one morning and finds that a six-figure balance of USD Coin (USDC) is gone.
All of his USDC was moved in five transactions to addresses the investor has never seen, without a single click or signature.
The first instinct is to ask Circle (issuer of USDC) to freeze the funds and reverse the transfer. The problem is that an issuer generally can’t do it.
This article explains why and what the GENIUS Act now requires of stablecoin issuers.
It also examines legal mechanisms available to freeze stolen USDC and pursue its recovery.
These could include providing notice to the issuer, getting assistance from (i) federal authorities through an asset forfeiture referral; (ii) obtaining a temporary restraining order (“TRO”) in New York Supreme Court; and (iii) navigating reissuance process in coordination with Circle and authorities.
Why Circle can’t simply reverse a stolen USDC transfer
The short answer is custody.
Once USDC reaches an external wallet, the tokens are controlled by whoever holds that wallet’s private key (not by the issuer).
The issuer does not have keys to a third party’s address. USDC is a token on a public blockchain; the issuer maintains the smart contract, but it does not hold the balances recorded in it.
What an issuer can do is block.
In an April 10, 2026 proposed rule, the Financial Crimes Enforcement Network (“FinCEN”) and the Office of Foreign Assets Control (“OFAC”) explained: “For example, a stablecoin issuer may be able to prohibit specific wallet addresses from interacting with the stablecoin and its smart contract. ”
Furthermore, Fincen and OFAC stated that “Applying such controls to a particular wallet address would effectively prevent the holder of a stablecoin from transferring, redeeming, or otherwise moving the stablecoin.” ([2]).
Finally, FinCEN notes that “In some cases, including when required by a lawful order, stablecoin issuers reissue stablecoins equivalent to burned or frozen funds to different wallets as part of efforts to recover and return funds to victims of criminal activity.” ([2]).
Whether a stablecoin issuer can do that for a given contract is a technical question a court may need to resolve on evidence.
What GENIUS Act requires of stablecoin issuers
The Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), Public Law 119-27, was signed on July 18, 2025 ([1]).
Section 4(a)(“Compliance with Lawful Orders”) says that “A permitted payment stablecoin issuer may issue payment stablecoins only if the issuer has the technological capability to comply, and will comply, with the terms of any lawful order.” ([1]).
Under §5901 (16). Definitions …”Lawful Order” is defined as “any final and valid writ, process, order, rule, decree, command, or other requirement issued or promulgated under Federal law, issued by a court of competent jurisdiction or by an authorized Federal agency pursuant to its statutory authority, that—(A) requires a person to seize, freeze, burn, or prevent the transfer of payment stablecoins issued by the person…” ([1]).
The definition is federal; a New York state-court order rests on New York law, discussed below.
The Act is not yet fully effective; under Section 20 it takes effect on the earlier of 18 months after enactment or 120 days after final regulations ([1]).
Even so, FinCEN stated that “”Additionally, with some regularity, Federal court orders require stablecoin issuers to burn and reissue an equivalent amount of stablecoins to a government-controlled wallet” ([2]).
Step one: report to IC3 and put the issuer on notice
File a complaint with the FBI’s Internet Crime Complaint Center (“IC3”) asap after your incident (include all details relevant to unauthorized crypto transfer).
In 2025, the IC3 Unit received 181,565 complaints involving cryptocurrency with $11.366 billion in reported losses ([6]).
FBI specifically encourages investors who suspect that criminals exploited DeFi smart contract to report to IC3 or a local field office ([7]).
At the same time, counsel should send the issuer, among other things, (i) a written notice of the theft; (ii)tainted blockchain addresses; (iii) the victim’s ownership claim. Also send the request that the addresses be blocked/frozen pending legal process.
Step two: work with federal authorities toward forfeiture
Forfeiture is how the government takes title to stolen stablecoins and returns them to victims.
On June 18, 2025, the Department of Justice (“DOJ”) filed a civil forfeiture complaint against more than $225.3 million in cryptocurrency tied to investment-fraud laundering.
“The Department of Justice thanks Tether for its … assistance in this investigation”, further described the effort as made “all with the eye toward making victims whole” ([4]).
Victims then recover through remission or restoration administered by DOJ’s Money Laundering and Asset Recovery Section. The agency reported returning “more than $13 billion in forfeited assets to victims” since 2000 and publishes a model petition under 18 US Code. § 981e)(6) ([5]).
The government decides whether and when to act. Accordingly, a well-prepared referral from counsel and former federal investigators matters (supported by blockchain analytics and crypto title reports); however, no outcome can be promised.
Step three: seek a TRO in New York Supreme Court
New York is a natural forum.
Circle Internet Group, Inc. lists its business address as One World Trade Center, New York, NY 10007 in its SEC filings ([11]).
New York State Department of Financial Services (“NYDFS”) lists Circle Internet Financial, LLC as licensed since September 2015. NYDFS also list Circle Internet Trust Company, LLC as chartered since July 2026 ([12]).
Under Civil Practice Law and Rules (“C.P.L.R.”) 6301 (“Grounds for Preliminary Injunction and Temporary Restraining Order (TRO) – “A temporary restraining order may be granted pending a hearing for a preliminary injunction where it appears that immediate and irreparable injury, loss or damage will result unless the defendant is restrained before the hearing can be had.” ([8]).
C.P.L.R. 6313(a) states that “Upon granting a temporary restraining order, the court shall set the hearing for the preliminary injunction at the earliest possible time.” Furthermore, the court may require an undertaking – “Undertaking. Prior to the granting of a temporary restraining order the court may, in its discretion, require the plaintiff to give an undertaking in an amount to be fixed by the court…” ([9]).
Depending on the facts, the relief sought against the unknown thief and the issuer may include restraining any transfer from the identified addresses.
Where the evidence shows it is technically feasible, directing the issuer to burn the frozen tokens and issue replacements to a court-supervised wallet.
Where the thief is a non-domiciliary or has secreted property, C.P.L.R. § 6201 also supplies grounds for attachment ([10]). “Grounds for attachment. An order of attachment may be granted in any action…when (1) the defendant is a nondomiciliary residing without the state, or is a foreign corporation not qualified to do business in the state…” Step four: from frozen to returned
A freeze is just the midpoint.
Frozen USDC comes back to a victim in one of two ways. Either through the federal forfeiture action, in which the government forfeits the tokens and a victim petitions for remission or restoration ([5]).
Or, alternatively, through a court order directing the issuer to burn the blocked tokens and reissue an equivalent amount to a wallet the court or the victim controls (mechanism FinCEN describes as already used with some regularity by federal courts ([2]).)
Which path applies depends on whether the government has opened a case and how quickly the freeze was obtained.
| Route | Who acts | Legal basis | What it can realistically achieve |
|---|---|---|---|
| Issuer notice | Circle, directed at counsel’s request | Issuer’s own compliance program; FinCEN-described blocking capability | Blocking of tainted addresses pending legal process; no voluntary reversal |
| Federal forfeiture | DOJ, FBI, U.S. Secret Service | 18 US Code § 981; 28 C.F.R. Part 9 remission and restoration | Government seizure, then return to victims through petition; timing controlled by the government |
| New York Supreme Court “TRO” | Victim, through counsel | C.P.L.R. 6301, 6313; CPLR 6201 attachment | Court-ordered freeze; burn-and-reissue where feasible; preliminary injunction hearing |
How Dilendorf Law Firm helps
Max Dilendorf is a New York crypto lawyer who has practiced cryptocurrency and blockchain law since 2017 and has represented hundreds of victims of crypto cybercrime, including holders whose USDC and other stablecoins were stolen through wallet drains, exchange account takeovers, SIM-swap attacks, and DeFi exploits.
Dilendorf Law Firm coordinates correspondence with Circle and its legal team to request that stolen funds be blocked, works with a team of retired FBI and Department of Justice experts to trace funds and prepare a forfeiture referral.
Depending on the facts and circumstances of the case, files a TRO action and preliminary injunction in New York Supreme Court (jurisdiction where Circle is based), so that frozen USDC can be burned and reissued to the victim.
The firm is counsel of record in more than 130 cybercrime-related arbitration matters before AAA, JAMS, and NAM. Represents U.S. and non-U.S. crypto cybercrime victims nationwide. Contact Max Dilendorf for a consultation about stolen USDC or other stablecoins, including Tether.
Contact US
Call +1 212 457 9797, email info@dilendorf.com, or request a consultation. Bring the wallet addresses, transaction hashes, dates, any IC3 complaint number, and every message exchanged with the issuer or exchange.
This article does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.
Frequently asked questions
Can Circle reverse a USDC transaction or return stolen USDC?
Not by simply moving the tokens back: once USDC sits at an external address, the issuer holds no private key for that address and cannot transfer tokens out of it. What an issuer generally can do is block a specific address from interacting with the stablecoin, which the Treasury Department describes as effectively preventing the holder from transferring or redeeming it ([2]). Blocking preserves the asset; a court order or federal forfeiture proceeding is then needed to move it.
How do you get Circle to freeze stolen USDC?
By written notice from counsel that identifies the theft, the tainted addresses, and the on-chain tracing, requests that the addresses be blocked pending legal process, and references the IC3 complaint. FinCEN’s proposed rule describes address blocking as a capability issuers may have, and the GENIUS Act conditions issuance on the “technological capability to comply” with lawful orders to seize, freeze, or burn tokens ([2]; [1]). A voluntary block is at the issuer’s discretion; a court order or government request is what compels it.
What is a “lawful order” under the GENIUS Act?
Section 2(16) of the GENIUS Act defines it as a final and valid order issued under Federal law by a court of competent jurisdiction or an authorized Federal agency that requires a person “to seize, freeze, burn, or prevent the transfer of payment stablecoins issued by the person,” identifies the stablecoins or accounts with reasonable particularity, and is subject to review or appeal ([1]). Section 4(a)(6)(B) then conditions issuance on the “technological capability to comply, and will comply,” with such orders ([1]).
Is the GENIUS Act in effect yet?
Not fully. Under Section 20, the Act takes effect on the earlier of 18 months after the July 18, 2025 enactment or 120 days after the primary federal regulators issue final implementing rules ([1]). FinCEN and OFAC published a joint proposed rule on April 10, 2026, with comments due June 9, 2026 ([2]), and the Congressional Research Service updated its overview of the Act on August 20, 2026 ([3]).
Can a court order a stablecoin issuer to burn stolen tokens and reissue them?
Federal courts have done so. FinCEN states that “with some regularity, Federal court orders require stablecoin issuers to burn and reissue an equivalent amount of stablecoins to a government-controlled wallet,” and that issuers sometimes reissue tokens “as part of efforts to recover and return funds to victims of criminal activity” ([2]). Whether a particular court will grant such relief to a private victim, and whether a particular contract permits it, depends on the evidence and the issuer’s technical capabilities.
Why file the TRO in New York Supreme Court?
Because the issuer is here. Circle Internet Group, Inc. reports its business address as One World Trade Center, New York, NY 10007 ([11]), and its affiliates hold New York DFS virtual currency and money transmitter licenses dating to September 2015 and a limited purpose trust charter granted in July 2026 ([12]). CPLR 6301 and 6313 allow a TRO, including without notice, where immediate and irreparable injury would otherwise result ([8]; [9]).
How does federal forfeiture return stolen stablecoins to victims?
The government seizes and forfeits the assets, then returns them through remission or restoration. DOJ’s Money Laundering and Asset Recovery Section reports returning more than $13 billion in forfeited assets to victims since 2000, provides a model petition under 18 U.S.C. § 981(e)(6), and never charges victims a fee for the process ([5]). In June 2025, DOJ filed a forfeiture complaint against $225.3 million in stablecoins linked to investment fraud with the issuer’s assistance ([4]; [2]).
How can USDC be stolen from a wallet without a signature?
Often through a stale token approval: an ERC-20 approval lets a smart contract move a set amount of tokens from a wallet at any later time, and if the approved contract is later compromised, the attacker can call it without the owner ever signing again. The FBI has warned that criminals “are increasingly exploiting vulnerabilities in the smart contracts governing DeFi platforms to steal cryptocurrency” and encourages victims to report to IC3 ([7]). Reviewing and revoking old approvals is a basic wallet-hygiene step.
Why hire a crypto lawyer who has practiced since 2017 for a stolen-stablecoin case?
Because the case turns on issuer mechanics, on-chain evidence, and forum choice, and it moves quickly. Max Dilendorf has practiced cryptocurrency and blockchain law since 2017, has represented hundreds of crypto cybercrime victims, and is counsel of record in more than 130 cybercrime-related arbitration matters before AAA, JAMS, and NAM. Dilendorf Law Firm coordinates with Circle’s legal team on freezing stolen USDC, works with retired FBI and DOJ experts on forfeiture referrals, and, where the facts support it, seeks a TRO in New York Supreme Court.
Sources
[1] Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), Pub. L. No. 119-27, 139 Stat. 419 (July 18, 2025), §§ 2(16), 2(22), 4(a)(6)(B), 20. https://www.govinfo.gov/content/pkg/PLAW-119publ27/html/PLAW-119publ27.htm
[2] Financial Crimes Enforcement Network and Office of Foreign Assets Control, U.S. Department of the Treasury, Joint Proposed Rule implementing the GENIUS Act (Bank Secrecy Act and sanctions obligations of permitted payment stablecoin issuers), 91 Fed. Reg. 18582 (Apr. 10, 2026), FR Doc. 2026-06963, including discussion of proposed 31 C.F.R. § 1033.240(b). https://www.federalregister.gov/documents/full_text/html/2026/04/10/2026-06963.html
[3] Congressional Research Service, “Stablecoin Legislation: An Overview of the GENIUS Act of 2025 (P.L. 119-27),” Insight IN12553, updated Aug. 20, 2026. https://www.congress.gov/crs-product/IN12553
[4] U.S. Department of Justice, Office of Public Affairs, Press Release No. 25-633, “United States Files Civil Forfeiture Complaint Against $225M in Funds Involved in Cryptocurrency Investment Fraud Money Laundering,” June 18, 2025. https://www.justice.gov/opa/pr/united-states-files-civil-forfeiture-complaint-against-225m-funds-involved-cryptocurrency
[5] U.S. Department of Justice, Criminal Division, Money Laundering and Asset Recovery Section, “Victims” (remission and restoration of forfeited assets), updated May 1, 2026. https://www.justice.gov/criminal/criminal-mnf/victims
[6] FBI Internet Crime Complaint Center, 2025 Internet Crime Report, pp. 17, 52. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
[7] FBI IC3, Public Service Announcement, “Cyber Criminals Increasingly Exploit Vulnerabilities in Decentralized Finance Platforms to Obtain Cryptocurrency, Causing Investors to Lose Money,” Aug. 29, 2022. https://www.ic3.gov/PSA/2022/PSA220829
[8] N.Y. Civil Practice Law and Rules § 6301, Grounds for preliminary injunction and temporary restraining order (New York State Senate). https://www.nysenate.gov/legislation/laws/CVP/6301
[9] N.Y. Civil Practice Law and Rules § 6313, Temporary restraining order (New York State Senate). https://www.nysenate.gov/legislation/laws/CVP/6313
[10] N.Y. Civil Practice Law and Rules § 6201, Grounds for attachment (New York State Senate). https://www.nysenate.gov/legislation/laws/CVP/6201
[11] U.S. Securities and Exchange Commission, EDGAR entity record, Circle Internet Group, Inc. (CIK 0001876042), business address One World Trade Center, New York, NY 10007. https://www.sec.gov/edgar/browse/?CIK=1876042
[12] New York State Department of Financial Services, “Virtual Currency Businesses” (list of licensed and chartered entities), entries for Circle Internet Financial, LLC (2015-09) and Circle Internet Trust Company, LLC d/b/a Circle New York Trust (2026-07). https://www.dfs.ny.gov/virtual_currency_businesses