Before a DEX can swap your USDC, you approve it to spend USDC. Many apps ask for an "unlimited" approval. If that contract is later hacked — or was malicious from the start — it can empty that token from your wallet.
Review and revoke old approvals with tools like Revoke.cash or your block explorer.