Circle Under Fire for Letting $285M Stolen USDC Move Freely During Drift Hack

Onchain investigator ZachXBT criticized Circle on April 2, 2026 for failing to act while millions in stolen USDC moved through its Cross-Chain Transfer Protocol (CCTP) during the $285 million Drift Protocol exploit, despite the issuer having frozen 16 business wallets days earlier in a sealed civil case.

The April 1 attack on the Solana-based decentralized exchange ranks as the largest DeFi exploit of 2026, with the attacker deliberately avoiding Tether’s USDT during bridging—suggesting confidence that Circle would not freeze the funds.

Drift Protocol Suffers $285 Million Exploit as Stolen USDC Crosses Unimpeded

Drift Protocol, a perpetual futures platform on Solana, suffered a massive vault drain on April 1, 2026. Security firm PeckShield and blockchain analytics platform Arkham Intelligence flagged approximately $285 million in outflows from Drift’s main vault to attacker-controlled wallets. The attacker moved stolen assets, heavily involving USDC, across multiple wallets before bridging them from Solana to Ethereum using Circle’s Cross-Chain Transfer Protocol (CCTP).

The transfers occurred during US business hours and continued for hours without any intervention from Circle. ZachXBT stated that Circle was “asleep” while many millions of USDC were swapped via CCTP from Solana to Ethereum during the nine-figure hack. Security researcher Specter noted that the attacker held USDC across wallets for one to three hours before swapping and deliberately avoided converting to Tether (USDT) during the bridging process, suggesting confidence that Circle would not freeze the funds—confidence that proved warranted.

Circle’s Inconsistent Freeze Policy Draws Hypocrisy Criticism

The timing intensified frustration. Just days before the Drift exploit, on March 23, 2026, Circle froze the USDC balances of 16 unrelated business hot wallets as part of a sealed US civil case. That action disrupted operations for exchanges, casinos, and payment processors. ZachXBT previously called that freeze potentially the most incompetent he had seen in over five years, arguing that on-chain analysis showed the wallets were engaged in legitimate activity.

Circle later unfroze one wallet linked to Goated.com on March 26, but most remained locked. The contrast is stark: Circle acted aggressively on a civil matter affecting businesses conducting what appeared to be normal operations, yet during a confirmed nine-figure theft from a DeFi protocol with stolen funds transiting its own bridging infrastructure in plain sight, the company took no action.

ZachXBT also tied this behavior to Circle’s proposed optional privacy features on its upcoming Arc blockchain, suggesting those features could reduce compliance accountability further by limiting who can view transactions.

Market Impact and Industry Debate

On the Ethereum side, the attacker swapped stolen assets for approximately 129,000 ETH. Drift’s total value locked collapsed from approximately $550 million to $247 million, a drop of more than half, and its native DRIFT token fell nearly 28%. The attacker has likely begun laundering funds through mixers or decentralized exchanges, making recovery increasingly unlikely.

The incident has reignited debate over whether centralized stablecoin issuers can justify their freeze authority if they apply it inconsistently. Stablecoin issuers market their products as neutral settlement layers for the decentralized economy, yet USDC and USDT both operate under terms granting unilateral freeze authority designed to comply with law enforcement requests and court orders. The problem is not that this authority exists—compliance is reasonable and expected—but that its application appears to depend more on who is asking than on what happened.

For builders and investors, the incident underscores that centralized stablecoin issuers are not neutral utility providers. They are gatekeepers with legal obligations, commercial incentives, and enforcement patterns that do not always align with the interests of the protocols that depend on them.

FAQ

What did ZachXBT accuse Circle of during the Drift hack?

ZachXBT accused Circle of failing to act while millions in stolen USDC moved freely through its Cross-Chain Transfer Protocol (CCTP) for hours during the $285 million Drift Protocol exploit, despite the transfers occurring during US business hours. He contrasted this with Circle’s aggressive freeze of 16 business wallets days earlier in a civil case.

How did the Drift attacker demonstrate confidence that Circle would not freeze the funds?

The attacker held USDC across wallets for one to three hours before swapping and deliberately avoided converting to Tether’s USDT during the bridging process, suggesting the hacker was confident Circle would not freeze the funds. That confidence was warranted as Circle took no action.

What was the market impact of the Drift hack?

Drift Protocol’s total value locked collapsed from approximately $550 million to $247 million, a drop of more than half, and its native DRIFT token fell nearly 28%. On the Ethereum side, the attacker swapped stolen assets for approximately 129,000 ETH, making recovery increasingly unlikely as funds are laundered.