Zama: cUSDC smart contract freeze was collateral damage from Overnight Finance rugpull

Zama’s co-founder Rand Hindi, has clarified that the blacklist placed by Circle on the protocol’s contract address had nothing to do with Zama at all. 

Reports show that approximately $12.6 million in user funds were locked in Zama’s confidential USDC token on Ethereum.

Why was Zama’s contract frozen?

Following reports that $12.6 million in user funds on Zama have become inaccessible, the company’s co-founder, Rand Hindi, took to X to give an explanation. He also gave credit to on-chain investigator ZachXBT for his role in identifying the source of the problem. 

The story goes that an address linked to the Overnight Finance hack had deposited more than $12.5 million USDC into Zama’s cUSDC wrapper. However, as the wrapper was not so popular at the time, that single deposit represented nearly 100% of all the funds in the contract.

“This has nothing to do with Zama, or privacy,” Hindi insisted on X. “The issue stems from an address related to the Overnight Finance hack.”

The USDT/USDC Ban List Telegram tracker shows that Zama’s contract address was frozen at 01:08 UTC on Friday. The targeted address, 0xe978…72B2, is publicly labeled on Etherscan as “Zama: cUSDC Token.”

Why did Circle’s ban affect uninvolved users?

Circle’s compliance system flagged the depositor’s wallet, but because those funds sat inside Zama’s cUSDC contract, a standard holding freeze was applied to the entire contract address rather than just the individual depositor. 

ZAMA’s token dropped by 18.2% intraday, falling from around $0.039 to $0.032 over roughly five and a half hours. Trading volume spiked to 61% in 24 hours to $73.9 million, nearly matching the token’s $77.5 million market cap. The token partially recovered to $0.035, but that’s still less than its value prior to the freeze. 

Hindi emphasized that the protocol “is not a mixer” and does not obscure senders or recipients, only balances and amounts. He pointed out the depositor’s cUSDC transaction history on Blockscout as evidence that transactions remain traceable.

As an immediate precaution, Zama paused its cUSDC, cUSDT, and cWETH contracts pending a full investigation. Hindi said the team would publish a post-mortem and a framework for handling future freeze requests.

If Zama’s legal team fails to convince Circle or the court that issued the restraining order to narrow the freeze to the specific flagged depositor, legitimate users who deposited USDC into cUSDC will remain locked out.