{
  "id": 8892398,
  "title": "A USDC deposit address with no private key — and the 9,999-block RPC cap that almost froze it",
  "url": "https://urgent.news/2026/09/21/a-usdc-deposit-address-with-no-private-key-and-the-9-999-block-rpc",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-21T09:34:41.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/edycutjong/a-usdc-deposit-address-with-no-private-key-and-the-9999-block-rpc-cap-that-almost-froze-it-el6"
  },
  "original_language": "en",
  "account": "A USDC deposit address was created on Arc, Circle's Layer 1 blockchain, that had no private key associated with it. The address was generated using a CREATE2 function, which allows for deterministic address generation based on an input salt. When a sweep operation was performed on this deposit address, the factory would deploy a throwaway contract that would move the USDC balance to the treasury, and then delete the account using SELFDESTRUCT. The entire process was observable on Arc, as PAID and SWEPT events were logged to the blockchain through eth_getLogs. However, attempting to scan a range of blocks larger than 9,999 would result in an error from the RPC, as it rejects any range larger than 10,000. This meant that any invoices older than approximately 85 minutes would have their status stuck at \"UNPAID\" if the scan was not chunked and incremental.",
  "summary": "Every deposit address an exchange hands out is a private key someone has to generate, store, guard and eventually sign a sweep with. I built a deposit address that has no key at all — and then, the evening before submitting it, found out the live page would have frozen at \"UNPAID\" a few hours after deploy. This is the mechanism, the bug, and what pinned it. Live: https://pigeonhole.edycu.dev/…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}