Onchain investigator ZachXBT accused Circle of failing to behave whereas thousands and thousands in stolen USDC moved freely by its personal cross-chain bridge through the $285 million Drift Protocol exploit.
The criticism adopted the April 1 assault on the Solana-based decentralized change, which ranks as the biggest DeFi exploit of 2026 thus far.
Circle Faces Backlash Over CCTP Inaction
Drift Protocol, a perpetual futures platform on Solana (SOL), suffered a large vault drain on April 1. Safety agency PeckShield and blockchain analytics platform Arkham Intelligence flagged roughly $285 million in outflows from Drift’s foremost vault to attacker-controlled wallets.
The attacker moved stolen property, closely involving USDC, throughout a number of wallets earlier than bridging them from Solana to Ethereum utilizing Circle’s Cross-Chain Switch Protocol (CCTP).
ZachXBT identified the transfers occurred throughout U.S. enterprise hours with no intervention.
Circle was asleep whereas many thousands and thousands of USDC had been swapped by way of CCTP from Solana to Ethereum for hours from the 9-figure Drift hack throughout US hours,” the blockchain investigator acknowledged.
Safety researcher Specter echoed these issues. He famous that the attacker held USDC throughout wallets for 1 to three hours earlier than swapping and intentionally prevented changing to Tether (USDT) through the bridging course of, suggesting confidence that Circle wouldn’t freeze the funds.
A Sample of Contradictory Responses
The timing intensified frustration. Simply days earlier than the Drift exploit, Circle froze the USDC balances of 16 unrelated enterprise scorching wallets on March 23, as a part of a sealed U.S. civil case.
That motion disrupted operations for exchanges, casinos, and cost processors.
ZachXBT beforehand known as that freeze probably probably the most incompetent he had seen in over 5 years. He argued that, based mostly on on-chain evaluation, the wallets engaged in legit exercise.
Circle later unfroze one pockets linked to Goated.com on March 26, however most remained locked.
The distinction is stark. Circle acted aggressively on a civil matter affecting legit companies. But throughout a confirmed nine-figure exploit, it took no steps to freeze stolen funds transiting its personal infrastructure.
ZachXBT additionally tied this conduct to Circle’s proposed non-obligatory privateness options on its upcoming Arc blockchain. He advised these options might scale back compliance accountability additional by limiting who can view transactions.
What Comes Subsequent for Circle and Drift
On the Ethereum aspect, stolen property had been swapped for roughly 129,000 ETH. Drift’s complete worth locked collapsed from roughly $550 million to $247 million, and its native DRIFT token fell almost 28%.
Circle has not publicly responded to the criticism. The incident has reignited debate over whether or not centralized stablecoin issuers can justify their freeze authority in the event that they apply it inconsistently.
The put up ZachXBT Slams Circle for Letting Hundreds of thousands in Stolen USDC Circulation Freely After Drift Hack appeared first on BeInCrypto.