Is USDC Safe to Hold? Reserves, Freezes and Controls

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. It depends on the risk you weigh. Circle's September 30, 2026 report, examined by Deloitte, shows $73.96 billion of reserves for 73.88 billion USDC. Circle can block any address, and an admin role can replace USDC's contract code.

Watch: Is USDC Safe to Hold? Reserves, Freezes and Controls 1:49

Video transcript

Is USDC safe? It depends on the risk you weigh: Circle's reserves, the powers Circle keeps, and the contracts the token runs on.

Circle's September 2026 report, examined by Deloitte, shows 73.96 billion dollars of reserves for 73.88 billion USDC in circulation.

About 84.5 percent sits in a BlackRock-managed government money market fund. Another 12.8 percent is cash at banks the report does not name.

But this is an examination, not an audit. It tests one claim, at two moments, on Circle's criteria, and says nothing about keys.

Bank exposure has bitten before. When Silicon Valley Bank failed in March 2023, USDC fell as low as 87.74 cents.

Circle can block any address, and blocked addresses can no longer send or receive USDC. At the end of September, 131.2 million USDC were blocked.

On Ethereum, an admin role can upgrade the contract code, and a pauser can halt all transfers. Bridged copies are not USDC and add bridge risk.

In the EU, Circle's French entity issues USDC under MiCA. In the US, the GENIUS Act takes effect on January 18, 2027, and USDC's permitted issuer is still open.

Before you hold, read the report, name your chain, read the roles, and screen destinations before sending.

Guardian's Managed Security maps every path to your funds, from contracts to keys. Read the full guide, or talk to Guardian at guardian.security.

USDC is a claim on Circle. Its value rests on the reserves behind it, the powers Circle keeps over it, and the contracts it runs on.

This guide gives no verdict. It lays out each risk with its source, what is still open, and checks you can run yourself.

For Tether's token, see Is USDT safe?

Reserves and Attestations

Circle publishes a monthly USDC reserve report with an accountant's opinion.

The latest covers two moments: September 4 and 30, 2026, at 11:59 pm UTC. Deloitte & Touche LLP signed its opinion on October 26, 2026.

On September 30, the report counts 73.88 billion USDC in circulation and $73.96 billion of reserves. That leaves $77.8 million over, about 0.1%.

Reserve asset, Sept 30, 2026	US$ billions	Share
Circle Reserve Fund	62.47	84.5%
Cash at regulated financial institutions	9.50	12.8%
US Treasury bills held directly	1.76	2.4%
Timing and settlement, net	0.23	0.3%

The surplus and shares are our arithmetic. Inside the fund sat $36.65 billion of overnight Treasury repos and $25.36 billion of Treasury bills.

Circle calls the fund "an SEC-registered 2a-7 government money market fund," managed by BlackRock. Circle Internet Financial, LLC owns all of its equity on behalf of USDC holders.

The bank cash sits in "unencumbered accounts held on behalf of USDC holders," segregated from Circle's corporate funds.

What the attestation does not cover

Deloitte ran an examination under AICPA attestation standards, for reasonable assurance. It is not an audit of Circle's financial statements.

One claim. It tests a single assertion: reserves were equal to or greater than USDC in circulation.
Two moments. The opinion covers the report dates, not the days between them.
Circle's criteria. Circulation excludes 1.86 billion tokens "allowed but not issued" and 131.2 million blocked USDC.
Balances only. It says nothing about who holds the token's roles or keys.

Events on the Record

Date	Event	Outcome
Mar 10, 2023	Silicon Valley Bank fails with $3.3B of USDC reserves	USDC falls as low as $0.8774
Feb 21, 2024	TRON moves to redemptions only	No new USDC issued there
Jul 1, 2024	Circle's French entity authorized under MiCA	Becomes a second USDC issuer
Jul 10, 2026	OCC final approval for Circle's national trust bank	Custody first; reserve management planned

The night SVB failed, Circle wrote that "$3.3 billion of the ~$40 billion of USDC reserves remain at SVB," CoinDesk reported.

Circle said the deposit "will be fully recovered when banks open on Monday in the U.S.," Forkast reported. In DefiLlama's hourly prices, USDC was back above $0.99 by about 10:00 UTC that Monday.

Freeze and Blacklist Powers

Circle's access denial policy says a blocked address "can no longer send or receive" USDC.

The policy limits blocks to three cases:

a threat to the network's security, such as a compromised minter key, in Circle's "sole discretion";
a law, regulation or legal order from a recognized US or French authority or court, or another with jurisdiction;
urgent law enforcement requests, sanctions or national security requests, and orders pending a treaty process.

Circle's USDC Terms, updated October 15, 2026, go further. Circle may block addresses it judges, in its "sole discretion," may be linked to illegal activity or breaches of the Terms.

Blocks hit addresses, not tokens. In the policy's words: "It is not possible to deny access to individual Circle Stablecoin tokens."

On September 30, 2026, 131.2 million USDC were access denied, the reserve report shows. The policy commits Circle to report that figure publicly.

Who holds the switch

We read USDC on Ethereum at block 26,358,894 on November 6, 2026.

The blacklister, pauser, owner and proxy admin were addresses with no contract code.
The master minter, which manages minters, was a contract.
On Solana, USDC's freeze authority was an SPL multisig needing 2 of 4 signers.

Circle's token design document says "Circle will control the address of all roles." The chain cannot show what signing control sits behind an address with no code.

Line by line, and how USDT differs: USDC and USDT freeze functions explained.

Contract and Chain Risk

USDC on Ethereum is a proxy. Circle's design document says only the admin "may call upgradeTo," which swaps the code behind the token.

A pauser can "pause the contract, which prevents all transfers, minting, and burning." USDC was not paused when we read it.

Circle's September report lists 39 "USDC Approved Blockchains," each a separate deployment with its own roles.

Issue and redeem: 37 chains, including Ethereum, Solana, Base and Arc.
Redeem only: TRON since February 21, 2024, and Noble since October 13, 2026.
Not USDC: bridged copies. Circle "supports only USDC and is under no obligation to support any copies of USDC or wrappers," its Terms say.

A bridged copy adds a bridge's risk to Circle's.

On Arc, Circle's own chain, public mainnet since September 16, 2026, USDC pays for gas and the chain enforces a blocklist.

How the chains compare: stablecoin chains compared.

Regulation in the US and EU

United States

Circle Internet Financial, LLC issues USDC. Its Terms say USDC is regulated as stored value under US money transmission laws, and New York's DFS licenses the company.

The GENIUS Act takes effect on January 18, 2027, the OCC's final rule says. Section 4(a)(6) requires permitted issuers to have "the technological capability to comply" with lawful orders.

Circle's national trust bank, First National Digital Currency Bank, N.A., won final OCC approval in July 2026.

At opening it offers custody to Circle and its affiliates. Managing the USDC reserve is "planned as a future capability."

Still open: the sources we read do not say which Circle entity will be USDC's permitted issuer under the Act, or under which regulator. Dates are in our GENIUS Act timeline.

European Union

Since July 1, 2024, Circle Internet Financial Europe SAS has also issued USDC. ESMA's register, last updated November 5, 2026, lists it as an electronic money institution authorized by France's ACPR.

That matters after ESMA's October 8, 2026 opinion: CASPs "should cease providing services related to non-MiCA-compliant stablecoins" to EU clients.

Checks to Run Yourself

Read the report itself. Check both dates, the criteria and what circulation excludes.
Watch the bank share. Bank cash was 12.8% of reserves on September 30, at banks the report does not name.
Name your version. Native USDC on which chain, or a bridged copy. Match the address to Circle's list.
Read the roles. Blacklister, pauser, owner and proxy admin on each chain you hold. Alert on any change.
Screen before sending. Call isBlacklisted on the destination first.
Know your exit. Redeeming directly with Circle needs a Circle Mint account.
Track the GENIUS move. Watch which entity and regulator USDC sits under after January 18, 2027.

How Guardian Helps

Guardian's Managed Security maps every path to your funds, from the contracts that hold them to the roles and keys that can move them.

It monitors your contracts on every block, with a Guardian engineer on every alert.

For platforms moving USDC for customers, fintech pentests attack the flows that approve withdrawals.

Frequently Asked Questions

Is USDC backed 1:1?

Circle's September 30, 2026 report shows $73.96 billion of reserves against 73.88 billion USDC in circulation, and Deloitte found that assertion fairly stated. About 84.5% sat in the BlackRock-managed Circle Reserve Fund and 12.8% in bank cash.

Can Circle freeze my USDC?

Yes. Circle can block any address. Its policy cites legal orders, urgent law enforcement, sanctions or national security requests, and network threats; its Terms add suspected illegal activity. On September 30, 2026, 131.2 million USDC were blocked.

Is USDC audited?

The monthly reserve report is examined rather than audited. Deloitte gives reasonable assurance, under AICPA attestation standards, that reserves covered USDC in circulation on the report dates. Circle also discloses reserve holdings weekly.

Is USDC MiCA compliant?

Circle Internet Financial Europe SAS is in ESMA's register of e-money token issuers, as an electronic money institution authorized by France's ACPR from July 1, 2024. It has issued USDC alongside Circle's US entity since then.

Sources

Know every path to your stablecoin funds

Guardian maps the contracts, roles and keys around the funds you hold, then watches them on every block with an engineer on every alert.

Talk to Guardian Explore Managed Security