On-chain investigator ZachXBT has accused Circle of failing to act as millions of stolen USDC flowed through its cross-chain infrastructure during the $285 million Drift Protocol exploit.
Backlash mounts over Circle’s inaction during exploit
The attack, which struck on April 1, is now the largest DeFi exploit recorded in 2026. Blockchain security firms PeckShield and Arkham Intelligence tracked approximately $285 million in funds drained from Drift’s vault and deposited into wallets controlled by the attacker.
#PeckShieldAlert Drift Protocol @DriftProtocol has been exploited, resulting in a loss of over $285M – more than 50% of its TVL. $DRIFT has plummeted by -37%.
The exploiter has already bridged the stolen assets from #Solana to #Ethereum via the CCTP TokenMessengerMinterV2,… pic.twitter.com/EZE4tP0f6c
— PeckShieldAlert (@PeckShieldAlert) April 2, 2026
A significant portion of the stolen funds, primarily in USDC, was bridged from Solana to Ethereum using Circle’s Cross-Chain Transfer Protocol (CCTP). According to ZachXBT, these transfers occurred over several hours during U.S. business hours without any intervention from Circle.
Security researcher Specter reinforced the criticism, noting that the attacker held USDC across multiple wallets for up to three hours before bridging. The deliberate avoidance of converting funds into USDT suggested confidence that no freezing action would be taken.
Contrasting actions raise compliance concerns
The incident has sparked wider debate due to Circle’s recent enforcement actions. Just days before the exploit, the company froze USDC held in 16 unrelated business wallets as part of a sealed U.S. civil case, disrupting exchanges, casinos, and payment processors.
ZachXBT had previously criticized that move as excessive, arguing that on-chain data pointed to legitimate activity. Although Circle later unfroze one wallet, most remained restricted.
This contrast, swift action in a civil matter versus inaction during a major exploit, has intensified scrutiny over how and when Circle exercises its control over USDC. Critics argue that inconsistent enforcement undermines trust in centralized stablecoin issuers.
Meanwhile, the fallout for Drift Protocol has been severe. The attacker reportedly swapped stolen assets into roughly 129,000 ETH, while the platform’s total value locked plunged from around $550 million to $247 million. Its native token also suffered a sharp decline.
Enjoyed this piece? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads and CoinMarketCap Community for seamless access to high-quality industry insights.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
