The Stablecoin Stack for Engineers

Where does a stablecoin actually live?

Not on a blockchain. The token is on a blockchain, but the dollar backing it sits in a money market fund at BlackRock. The compliance logic runs on the issuer's backend servers, the mint authorization flows through an access-controlled smart contract function, the attestation report comes from Deloitte, and sanctions screening happens at an address level the blockchain itself has no concept of.

A stablecoin is a thin on-chain wrapper around a thick off-chain stack. Understanding the wrapper is the easy part. Understanding the stack underneath is where the engineering gets interesting.

Six layers, one dollar

When a company sends $10 million to Circle and receives USDC, the dollar passes through six layers of infrastructure. Each layer has its own trust assumptions, failure modes, and regulatory owners.

Start at the bottom: reserve custody. Circle's reserves sit primarily in the Circle Reserve Fund, a government money market fund managed by BlackRock and held at BNY. The remainder is cash deposits at banks including JPMorgan, BNY, and Customers Bank. As of October 2026, USDC's reserves total roughly $73 billion. Tether's USDT backs its $140 billion in circulation with US Treasuries, money market funds, reverse repos, and gold, held across custodians including Cantor Fitzgerald.

The reserve composition matters because it determines what happens during a bank run. When Silicon Valley Bank failed in March 2023, Circle disclosed $3.3 billion in USDC reserves at SVB. USDC depegged to $0.87 before the FDIC announced depositor protection. The Circle Reserve Fund was created after that event, concentrating reserves in government money market instruments that sit outside the banking system's deposit risk.

The attestation layer

Reserves exist. Proving they exist is a separate engineering problem.

Circle publishes monthly reserve reports attested by Deloitte under AICPA attestation standards. The reports break down holdings by asset type, confirm the total matches or exceeds USDC in circulation, and carry a CPA firm's signature. Tether publishes quarterly through BDO Italia with a similar structure.

Neither report is a financial audit. An attestation confirms a specific fact at a specific point in time: on this date, reserves equaled or exceeded circulating supply. It does not examine internal controls, assess ongoing solvency, or test for fraud. The distinction is important for engineers building systems that depend on stablecoin stability. An attestation tells you the snapshot was clean. It says nothing about the 29 days between snapshots.

The GENIUS Act, signed July 18, 2025, formalized this requirement. Permitted stablecoin issuers must publish monthly attestation reports from a registered public accounting firm. For issuers above $50 billion in circulation, the Federal Reserve takes over supervision, which adds continuous examination on top of the monthly reports.

Mint and burn contracts

The token supply is controlled by smart contract functions that only authorized addresses can call. In USDC's architecture, Circle maintains a set of minter addresses, each with a configurable allowance. A minter can create tokens up to its allowance without further approval. The master minter role can add or remove minters and adjust allowances.

The mint function checks three things: the caller has minting privileges, the amount doesn't exceed the caller's remaining allowance, and neither the caller nor the recipient is on the blocklist. If all three pass, the contract increases total supply and credits the recipient.

Burning works in reverse. The caller must hold the tokens being burned and must not be blocklisted. The contract decreases total supply and debits the caller's balance. Circle processes redemptions through its API, where additional identity verification and AML screening happen before the burn is executed on-chain.

This two-layer architecture, API plus smart contract, means the compliance checks happen twice: once at Circle's backend (identity, sanctions, transaction monitoring) and once at the contract level (blocklist enforcement). The redundancy is intentional. Even if a sanctioned entity bypasses Circle's API and receives USDC through a DEX trade, the contract-level blocklist prevents those tokens from moving further.

The compliance surface

A stablecoin token contract is unusual among ERC-20 implementations because it includes administrative functions that most token contracts don't need.

The blocklist is the most visible. Both USDC and USDT maintain on-chain address blocklists. When OFAC designates an address, the issuer adds it to the blocklist. Any transfer involving a blocklisted address reverts. The enforcement is atomic: it happens inside the transfer function itself, before any balance change occurs.

The pause function is more blunt. Circle can pause the entire USDC contract, halting all transfers globally. This is the emergency brake for a scenario like a critical vulnerability in the contract code. It has never been used on USDC's primary deployments, but the capability exists and is auditable on-chain.

Upgrade mechanics add another surface. USDC uses a proxy pattern where the contract address stays the same but the implementation can be swapped. Circle can deploy a new implementation contract and point the proxy to it, changing the token's behavior without requiring every holder to migrate. This is how Circle shipped the v2 and v2.1 upgrades that added gasless approvals and other features.

For an engineer evaluating whether to integrate stablecoins into a payment system, these admin functions are the first place to look. The contract is not neutral infrastructure. The issuer retains the ability to freeze individual balances and halt the entire system. Those capabilities exist because regulators require them, but they also mean the risk model for holding stablecoins includes issuer operational risk in ways that holding ETH or BTC does not.

Bridge and settlement infrastructure

A stablecoin minted on Ethereum needs to work on Solana, Base, Arbitrum, and a dozen other chains. The bridging layer handles this, and it introduces its own trust assumptions.

Circle operates CCTP (Cross-Chain Transfer Protocol) for native USDC. When a user burns USDC on Ethereum through CCTP, Circle's off-chain attestation service observes the burn and produces a signed attestation. The user presents that attestation on the destination chain, where a CCTP contract verifies Circle's signature and mints native USDC. The tokens on both chains are backed by the same reserves, because Circle controls minting on every chain.

This is different from third-party bridges like Wormhole or LayerZero, which lock tokens on one chain and mint wrapped versions on another. Wrapped USDC on a third-party bridge is backed by locked USDC, not by Circle's reserves directly. If the bridge is exploited, the wrapped tokens lose their backing even though the underlying USDC is fine. Over $2 billion has been lost to bridge exploits since 2021, which is why Circle built CCTP as an alternative to third-party wrapping.

For settlement, the chain choice determines finality guarantees. Ethereum offers probabilistic finality in roughly 12 minutes after the Merge. Solana provides optimistic confirmation in about 400 milliseconds. Base, as an Optimism rollup on Ethereum, settles to L1 with a 7-day challenge window for fraud proofs. An engineer building a payment system on stablecoins has to decide which finality guarantee matches their risk tolerance, because a payment "confirmed" on an L2 isn't necessarily final on L1.

On-ramp and off-ramp

The edges of the stablecoin stack are where fiat enters and leaves the system, and they remain the slowest and most expensive layer in the stack.

On-ramping requires the user to pass identity verification, often at IAL2 or equivalent. The user sends dollars via wire, ACH, or card payment to the stablecoin provider. The provider holds funds until the fiat transfer clears, typically same-day for wires, 1-3 days for ACH. Only then does the provider trigger the on-chain mint. For institutional customers using Circle's API, the process is faster because the relationship is pre-established and the ACH pull can be pre-authorized.

Off-ramping reverses the process but adds friction. The user initiates a redemption through the provider's interface. The provider screens the transaction against sanctions lists and transaction monitoring rules. The tokens are burned on-chain. The provider initiates a wire or ACH push to the user's bank account. Settlement depends on the banking rail: same-day for Fedwire, next-day for ACH.

BVNK, now owned by Mastercard, operates as a conversion layer between stablecoins and fiat across 130 jurisdictions. Their infrastructure handles the on-ramp and off-ramp for institutional customers, connecting stablecoin settlement to the card network's existing merchant and acquirer relationships. Mastercard's acquisition of BVNK was essentially a purchase of this conversion layer at scale.

The on-ramp and off-ramp layer is where most of the regulatory compliance cost concentrates. The blockchain itself doesn't know or care about KYC. The issuer's backend, the on-ramp provider, and the off-ramp provider each run their own identity verification and transaction monitoring. For a stablecoin payment that crosses two providers, KYC happens at least twice, sometimes three times if the receiving bank also runs checks.

Where the GENIUS Act draws the lines

The GENIUS Act created a federal framework that maps onto this stack. Issuers of "permitted payment stablecoins" must hold one-to-one reserves in cash, short-term US Treasuries (93 days or less to maturity), or approved money market funds. Monthly attestations are mandatory. Issuers must implement Bank Secrecy Act AML programs and maintain the ability to freeze tokens for OFAC compliance.

Two constraints in the Act shape the economics. Payment stablecoins cannot pay interest or yield to holders. And issuers above $50 billion in circulation fall under direct Federal Reserve supervision rather than state regulators.

The interest prohibition matters because it defines the business model. Circle earned $1.66 billion in reserve income in 2024 and $2.64 billion in 2025. That yield belongs to Circle, not to USDC holders. Tokenized bank deposits, by contrast, can pay interest because they're classified as deposits rather than payment instruments. This regulatory distinction, not any technical difference, explains why banks are building their own tokenized deposit networks instead of adopting USDC.

FinCEN and OFAC proposed implementing rules in April 2026, but as of October 2026 the final rules remain in proposal stage. The July 2026 deadline passed without finalization. The Act sets the framework, but the specific compliance obligations, particularly around transaction monitoring and suspicious activity reporting for stablecoin issuers, are still being written.

What the stack actually looks like in production

Zoom out and the stablecoin stack has a pattern that should be familiar to any engineer who has worked with payment infrastructure. The on-chain layer is a thin settlement rail. The off-chain layers handle identity, compliance, risk management, and fiat conversion. The smart contract enforces balance rules and blocklists. Everything else runs on traditional infrastructure, databases, APIs, banking relationships, and regulatory licenses.

The engineering challenge of building on stablecoins is managing the seams between these layers. A mint request might pass Circle's API validation but hit a blocklist at the contract level. A cross-chain transfer might confirm on the source chain while the destination chain's attestation service is delayed. Each seam is a potential state inconsistency, and each inconsistency costs money.

For a team evaluating stablecoins as settlement infrastructure, the question is how much of this stack you want to own versus rent. Circle's API covers reserve management and minting, BVNK handles fiat conversion across 130 jurisdictions, and CCTP manages cross-chain movement. Each layer you outsource removes engineering complexity and adds counterparty risk. The tradeoff is the same one every infrastructure decision comes down to: control versus operational burden.