Circle CSO: USDC Freezes Based on Legal Requirements

Circle, the issuer of the USDC stablecoin, is defending its decision not to freeze stolen funds during a major exploit of the Solana-based derivatives exchange Drift Protocol. The company asserts that its ability to freeze assets is governed by strict legal requirements rather than internal discretion or community pressure.

The controversy follows an exploit on April 1, 2026, where the Drift Protocol was drained of approximately $285 million. Approximately $230 million of the stolen funds were in USDC. The attack was executed by North Korean state-sponsored hackers who carried out 31 withdrawals in 12 minutes following a six-month social engineering campaign.

Legal Constraints on Asset Freezes

On April 10, 2026, Circle’s Chief Strategy Officer Dante Disparte clarified via a blog post and X that the freezing of USDC is based on legal requirements rather than arbitrary judgment. Circle maintains that it is a regulated company that complies with court-mandated requirements, law enforcement orders and sanctions.

According to Circle’s Access Denial Policy, blocking assets is considered an exceptional measure. The company stated it primarily employs its freeze powers in three specific scenarios:

• Law enforcement or court orders
• Major security incidents
• Sanctions compliance

Circle argued that it could not freeze the USDC linked to the Drift exploit without a proper legal process or evidence that met its specific access-denial criteria. This position is reflected in the company’s terms of service, which state that Circle may be required to freeze USDC if it receives a legal order.

Criticism of Response Times

The decision not to act immediately drew sharp criticism from security researchers and on-chain investigators. The stolen USDC was bridged from Solana to Ethereum over a roughly six-hour window. Critics argue that Circle could have blacklisted the receiving addresses to stop the movement of funds during this period.

On-chain investigator ZachXBT highlighted that the transfers occurred during U.S. Business hours without intervention. ZachXBT further alleged that Circle has been inconsistent or slow in at least 15 cases involving more than $420 million in allegedly illicit USDC since 2022.

The scrutiny intensified when critics compared the Drift response to a separate incident on March 23, 2026, where Circle froze 16 operational business wallets in a sealed U.S. Civil matter. One of those wallets belonged to the gaming platform Goated.com, which Circle later unfroze, leading to questions regarding the consistency of its internal review process.

Impact on Drift Protocol and Regulatory Outlook

The exploit had a severe impact on the Drift ecosystem. The protocol’s total value locked dropped from $550 million to under $250 million, and the DRIFT token fell 77% from its all-time high.

Circle is using the incident to advocate for clearer regulatory frameworks. The company is urging the U.S. Congress to pass the GENIUS Act and the CLARITY Act. Circle suggests that the current lack of defined rules creates a gap where the company is criticized for not acting, yet lacks the legal framework to do so without formal compulsion.

The incident has renewed the broader industry debate regarding the tension between the centralization of regulated stablecoins and the decentralized nature of the blockchain ecosystem, specifically concerning who holds the power to freeze assets during security breaches.