What you're actually holding when your wallet says "USDC"
Fourteen months ago the GENIUS Act became law, and the sentence I now hear most often from advisers is some version of "stablecoins are regulated now, so they're safe." I understand the relief in it. It is also the wrong lesson, and the gap between what the law fixed and what it left alone is exactly the kind of thing that ends up in an examination file.
The problem starts with the word. "Stablecoin" names one thing. What you hold is four things at once, stacked on top of each other, and only the top one is visible in a wallet. Three of the other three can fail — independently, on different timelines, for different reasons. The law reinforces two of them. It does nothing for the one your client is least equipped to see.
Let me take the four in order.
At the top is the abstraction — "one dollar." This is the layer everyone sees and the layer everyone stops at. It is also the only one of the four that cannot break, because it isn't a thing, it's a denomination. A dollar's worth is a dollar's worth the way a mile is a mile. If your analysis ends here, you haven't analyzed anything; you've read the label.
Everything that can go wrong is underneath.
A stablecoin is a claim on an issuer — a legal obligation to give you a real dollar for the token. That promise can break three ways.
The issuer can decline to pay you: every major stablecoin contract has a freeze function, and issuers use it, generally under legal or law-enforcement order. Your client's tokens can be frozen at an address without warning and without the client having done anything wrong — caught in a dragnet aimed at someone upstream. The issuer can be unable to pay: insolvency, however remote it feels for the large names, is the entire reason redemption priority and reserve rules exist. Or the issuer can be barred from paying you specifically — sanctions, jurisdiction, a KYC wall.
Here the GENIUS Act does real work. It defines who may issue a payment stablecoin, requires redemption at par, and forces executive certification of the reports behind it. What a statute cannot do is make an offshore issuer honor a claim in a court that can reach it, and it does not remove the freeze function — it presumes it. The promise is stronger than it was. It is not unconditional.
Behind the promise sits the pile of assets meant to fund it. This is the layer people think they understand — "is it fully backed?" — and it is the layer whose failure mode they consistently misjudge, because a reserve can be entirely real and still break the peg.
The cleanest illustration is March 2023. Circle disclosed that roughly $3.3 billion of USDC's reserves — about 8% of the total — was sitting at Silicon Valley Bank when SVB failed on a Friday. The money wasn't gone. It was unreachable over a weekend, and the market could not be certain it would come back, so USDC traded as low as 88 cents for about forty-eight hours before the deposits were made whole. Fully backed, and still 12 cents off par, because backing you cannot touch on a Friday night is not the same as backing.
GENIUS tightens this layer hard. Permitted reserves are now a narrow list — cash, insured bank deposits, short-dated Treasuries, overnight repos, government money-market funds — with no rehypothecation, monthly public disclosure of composition, and third-party examination. Read that composition, because it is now where the names diverge. Circle's USDC reserves sit in a BlackRock-managed government money-market fund with monthly Deloitte attestations — close to what the statute contemplates. Tether's most recent attestation, by contrast, reports something on the order of $50 billion in gold, bitcoin, corporate bonds, secured loans, and equities alongside its Treasury holdings — asset classes that do not qualify as reserves under GENIUS at all. I am not telling you what to conclude from that. I am telling you it is a fact you can now read off a monthly report, and that "backed" and "backed by what, held where, reachable when" are different questions.
The bottom layer is the one nobody checks and the law does not touch: the specific on-chain instrument actually sitting in the wallet.
Here is the thing that surprises people. "USDC" on one chain may be Circle's native token — the real liability, redeemable with the issuer. "USDC" on another chain may be a bridged representation: an IOU minted by a bridge that locked the real USDC somewhere else and issued a copy here. Same name. Same ticker. Same six characters in the wallet. Different instrument, with a different backer — not Circle, but a bridge's smart contract and whoever controls it.
When that bridge is exploited, the copy is backed by nothing. Bridged USDC on Fantom fell to roughly 22 cents when the Multichain bridge was drained in 2023 — not depegged in the SVB sense of temporary and recoverable, but severed, because the collateral that stood behind it had been stolen and the issuer's promise never extended to it in the first place. Circle owes nothing on a token Circle did not issue.
The GENIUS Act regulates the issuer. It says nothing about the bridge that manufactured the copy your client is holding, and a wallet gives you no way to tell the two apart by looking. This is the layer that will surprise people, precisely because it is invisible at the exact moment it matters.
Three general observations, none of which is advice about your particular clients or firm.
1. "Which stablecoin" is the wrong question. The right one is "which token, on which chain, reached by which path." Native versus bridged is a diligence item you can settle today: every major issuer publishes the list of chains where it deploys the native asset. If a holding isn't on that list, it's a copy, and its risk is the bridge's risk, not the issuer's.
2. The reserve report is now a monthly document — treat it like one. The disclosures exist because the statute compels them. The useful questions aren't "is it backed" but "in what, at which institutions, and what happens to access on a bank holiday." Those are answerable from the report and from the issuer's banking arrangements.
3. Freeze is a feature, and it can catch a client who did nothing. Know that the issuer can freeze a balance, know the process that triggers it, and know that "regulated" makes this more likely to be exercised cleanly, not less.
And the through-line: a stablecoin's promise is only as strong as the weakest of its four layers, and the law you keep hearing about reinforces the middle two. The top layer never needed help. The bottom layer — the token actually in the wallet — is the one left entirely to your diligence, and it's the one your client can't see.
GENIUS Act of 2025 (S.394) — the reserve, redemption, and disclosure sections are the ones worth your time; they define Layers Two and Three and, by their silence, Layer Four.
Worth reading alongside it: Circle's own account of the March 2023 SVB episode — a stablecoin issuer explaining, in its own words, how fully-backed reserves still broke the peg for a weekend. It is the clearest short lesson available on why Layer Three fails even when the money is real.
Figures and reserve compositions in this issue are current as of September 2026 and change monthly; check the latest attestation before relying on any of them.
RiverForge Research is published on a regular schedule for a general audience. It is not investment, legal, or tax advice, contains no recommendation to buy, sell, or hold any asset, stablecoin, or protocol, and is not tailored to any reader's circumstances. Theresa Gosiengfiao is the founder of RiverForge, which builds digital-asset infrastructure for institutional clients and may have a commercial interest in topics discussed. No compensation is received from any issuer, protocol, or platform mentioned. Reply with questions about how something works — but I can't advise on your specific book or clients.