Thanks to
@zachxbt, we found the root cause and will be taking the appropriate actions to unblock the situation. Tldr; this has nothing to do with Zama, or privacy.
The issue stems from an address related to the Overnight Finance hack, which deposited over ~$12.5m USDC into our confidential USDC wrapper contract. Back when they did, their address wasn't on any sanctions list and was not flagged by our KYT tools. However, a court order yesterday night placed a restraining order on various wallets linked to the hacker.
Since there wasn't much utility yet for the cUSDC wrapper, there were very little funds in it, and as a result the vast majority (>99%) of funds in the cUSDC contract came from that single hacker's deposit. Because of this, the court order asked to freeze our wrapper contract to freeze the hacker's fund.
So the sanction was not against Zama, or against privacy. It was a classic restraining order as we see often in DeFi, and we should have been notified so we could have taken the appropriate actions on our side.
I want to be very clear about something: our posture has always been compliant confidentiality, and we will not tolerate any illicit behavior in our protocol. It's also really useless for hackers to try to use Zama to hide their trail as we are precisely not a mixer and we do not obfuscate the sender and recipient, only balances and amounts. Eg you can see the hacker's cUSDC transactions here:
eth.blockscout.com/address/0β¦
We are in touch with the various people involved to resolve the situation asap. In the meantime, we will pause the cUSDC, cUSDT and cWETH contracts until we have finished our investigation, identified all addresses linked to this case and taken appropriate action.
I will share a more detailed post-mortem and how we plan to deal with such requests in the future.