Circle’s Cross-Chain Transfer Protocol (CCTP) is quickly becoming the backbone for stablecoin interoperability. Unlike conventional bridges, which wrap tokens and often introduce risk via third-party custody or smart contract vulnerabilities, CCTP operates on a native burn-and-mint model. USDC is burned on the origin chain and reissued on the destination - ensuring a consistent, auditable, and capital-efficient flow.

This architectural clarity makes CCTP flows particularly valuable to study. Over the past 12 months, Range observed over 1.2 million transactions, totaling $25.85 billion in volume. That activity wasn’t uniform. It revealed interesting contrasts in user behavior, timing patterns, and probable automation at play - shedding light on both institutional and retail stablecoin usage.

The following analysis is based on transactions we monitored through our USDC Explorer and Cross-Chain Explorer for the period from 18 July 2024 - 2025, across 11 CCTP-enabled networks (Ethereum, Arbitrum, Solana, Base, Aptos, Avalanche, Noble, Sui, Optimism, Polygon and Unichain). The data analyzed is for CCTP v1 transactions, and does not include the newly released CCTP v2 transactions, which we started tracking in May 2025.

This is the first in our Stablecoin Onchain Series. Be the first to read the next research piece by joining our mailing list.

1. Participation: Over half a million unique wallets

Over the analysis period, 282,370 unique senders and 262,888 unique receivers engaged in CCTP transfers. This high participation rate underscores CCTP’s success in onboarding users across ecosystems - especially given that it does not yet operate across all major chains.

Even more notable is the low average transaction count per user: 4.3, with 62.8% of wallets used only once. This hints at a user base composed of frequent one-time bridge users - retail DeFi participants shifting USDC between networks for specific dApps or trading opportunities, rather than repeat institutional actors alone.

Taken together with the analysis below, the data suggest that CCTP’s user base is largely retail users, even though institutional flows dominate in volume.

Circle, developers of CCTP, do not maintain any end-user interface for CCTP. All flows are driven by direct contract calls or through integrator UIs (bridge apps, wallets, exchanges, etc.) As such, for developers building wallets or cross-chain dApps, this is a key insight: the majority of users may be interacting with your bridge interface only once or twice. Clear UX, transaction status monitoring, and post-transfer follow-up matter. 

Tools like Range’s Monitoring & Alerts can help you track stuck transactions, detect retries, and improve onboarding, while our Cross-Chain Explorer API enables you to display the status of multi-hop bridging transactions to your users with ease.

2. Transaction size distribution: A sharp contrast between retail and whale activity

The distribution of USDC transfer sizes shows a distinct polarity between retail and institutional behavior. While the median transaction value was just $219.36, the average was significantly higher at $17.6k, indicating that large-value transfers disproportionately skew the total volume.

The distribution of transaction volumes are skewed throughout - 50% of transactions were for less than $219.36; 90% of transactions were for less than $18.8k; while just 1% of transactions exceeded $500,000. This disparity confirms that a small cohort of high-volume users - likely exchanges, market makers, or DeFi protocols - are responsible for a significant share of capital movement.

Overall, the top 0.1% of transactions (by value), accounted for 70.8% of the total USDC volume over CCTP, with the top 5% accounting for 96.6% of all volume. (Note the bars in the chart exclude the group listed to its left. e.g., the "Top 1%" group represents all of the Top 1% excluding the Top 0.1%)

This dual behavior reinforces that CCTP serves two distinct audiences: everyday DeFi users or apps moving modest funds, and institutional players orchestrating large transfers. From a security and monitoring perspective, these cohorts require different observability models.

Range’s Monitoring & Alerts platform enables stablecoin issuers and compliance teams to segment activity across these value bands and detect anomalies - whether it’s an unusually high-value outflow from a protocol wallet or clustering of micro-transactions that may signal botnet activity. 

3. Temporal patterns suggest scheduled automation at scale

One of the most striking observations in the data is the time-based clustering of high-volume transfers. Volume consistently peaks at XX:00 - XX:01, XX:30 - XX:31, and XX:50 - XX:51 on the minute. In contrast, transaction count does not follow this exact pattern.

This decoupling of volume and count implies that a relatively small number of transactions – executed at specific clock-bound intervals – are responsible for a disproportionate share of total USDC movement. These are likely driven by:

• Institutional scripts that execute cross-chain treasury operations at fixed times.

• Market-making bots balancing liquidity across Ethereum L2s and Solana (the top network routes for CCTP).

• Bridge relayers or custodial operators performing hourly or half-hourly netting.

The exact scheduling and clustering further point to automation: the precision of these intervals is not a result of human behavior. It may also tie into Circle’s own batching or finalization schedules, depending on how CCTP handles minting authorizations across different networks.

If your business operates a stablecoin wallet, treasury module, or onchain accounting system, monitoring for these clock-bound spikes can reveal counterparties and improve execution timing.

4. Transaction frequency follows a distinct 3-minute rhythm

While high-volume transactions occur at the predictable times mentioned above, the transaction count exhibits a subtle yet persistent 3-minute cycle. That is, most CCTP transfers occur at :00, :03, :06, :09, and so on, across the entire day.

This rhythmic pattern suggests batch processing or coordinated action across a wide set of actors - likely via bots or some type of embedded SDKs. It could be influenced by:

• The behavior of frontends or wallets initiating transfers on preset schedules.

• Network-level propagation and mempool rebroadcasting.

• Gas or priority fee optimization techniques that queue transactions into efficient intervals.

This cycle would be nearly impossible to observe without the cross-chain, time-granular monitoring provided by Range’s platform. The insight is critical for infrastructure teams: if you operate a relayer, validator, or RPC service supporting CCTP flows, expect peak loads at exact 3-minute intervals.

5. Time-of-day patterns reveal regional user base

Overlaying transaction volume by hour (UTC) shows a pronounced peak starting from 08:00 UTC, tapering off by 18:00 UTC. This pattern strongly suggests a high concentration of EMEA-based activity, with transaction initiations aligning closely with working hours in Europe and the Middle East.

Daily activity begins with a noticeable spike at 08:30 UTC (around the 500-minute mark), dips slightly around 11:30 UTC, and then rises again between 13:00 and 15:00 UTC (800–900 minutes). Activity tapers off after 16:30 UTC, sees a minor bump in the early evening, and then gradually declines through 21:30 UTC, remaining low overnight until the next morning’s cycle begins.

These intraday fluctuations suggest that, beyond the predictable automated transaction spikes, a significant portion of CCTP usage is driven by human behavior - with the majority of activity likely originating from the EMEA region. For context, 08:30 UTC corresponds to 09:30 in London and 10:30 in Berlin - typical start-of-day hours for finance and tech teams. In contrast, the same 08:30 UTC moment falls at 1:30 a.m. in California and 4:30 a.m. in New York, which are unlikely to represent peak working hours for US-based participants.

While these times align with late-afternoon hours in Asia (17:30 in Japan, 16:30 in China, 14:00 in India), those regions typically show different usage profiles for cross-chain stablecoin flows. Taken together, the data support the hypothesis that a large share of non-automated CCTP volume is initiated by humans operating in European and Middle Eastern time zones.

Interestingly, there’s no equivalent peak in the later US hours (20:00–02:00 UTC), which may imply that:

• US-based institutions schedule large-value CCTP flows in the early morning to coincide with European market overlap.

• Retail US users may prefer using alternative bridge protocols or operate through intermediaries like centralized exchanges.

• EMEA-based protocols or dApps are disproportionately adopting CCTP, possibly due to wallet integrations or regulatory compliance tooling.

Overall, transaction activity seems to be highest on Thursdays, between 12:00 and 15:00 UTC.

For builders and stablecoin issuers, this is a directional signal: CCTP is gaining traction in markets where time-based predictability matters, possibly due to banking integrations or enterprise scheduling.

6. Weekday vs. Weekend volume signals institutional footprint

The contrast in weekday vs. weekend activity is another subtle – but telling – indicator. Transaction counts remain relatively stable through the week, but total volume drops significantly on weekends, particularly on Saturdays.

This behavior is classic institutional signaling. Retail users tend to bridge USDC as-needed, including weekends. But high-volume transactions are more likely to be operational flows - scheduled treasury rebalancing, cross-chain liquidity provisioning, or custodial reallocation - typically paused over weekends.

This means that a sizable share of CCTP usage is governed by operational hours, not just network availability. If you’re building for financial institutions, custodians, or DeFi protocols handling TVL at scale, this data confirms that weekday observability is critical - and weekends are your anomaly detection window.

Implications for ecosystem security, monitoring, and strategy

By analyzing just one year of native USDC flows across CCTP, a few key themes emerge:

• Stablecoin flows are structured. Large-volume transfers are not random - they are coordinated, scheduled, and heavily reliant on automated execution. This makes them traceable and observable.

• Retail and institutional patterns are distinct. Retail drives breadth; institutions drive depth. Security tooling must treat them differently.

• Time matters. Understanding when money moves is as important as where or how. Peaks on the hour or every three minutes are exploitable signals - for frontrunning or optimization.

• Cross-chain observability is mandatory. Without the holistic visibility of Range’s Cross-Chain Explorer, these insights would remain siloed across chains.

As Circle expands CCTP and more dApps rely on it to move stablecoins cross-chain, tools offered by Range can help your compliance teams and growth analysts alike.

Explore these flows in real-time, trace specific wallets or analyze volume anomalies via the Range USDC Explorer and Cross-Chain Explorer. Or get in touch to try Faraday, our new all-in-one API for sending and receiving stablecoin transactions with built-in security, fraud detection, and compliance.

This is the first in our Stablecoin Onchain Series. Be the first to read the next research piece by joining our mailing list.

This article was written by Syed Choudhury, based on data and analysis conducted by Daniel Fiuza Dosil - Lead Data Scientist at Range.