Circle Under Fire Over Response to $285 Million Drift Hack

Stablecoin issuer Circle is facing criticism from members of the cryptocurrency community following a $285 million exploit of the Solana-based Drift protocol. Critics allege the company failed to act quickly enough to freeze stolen funds, which allowed a significant portion of the assets to be moved across blockchains.

The attack on Drift, the largest perpetual futures exchange on the Solana blockchain, began on April 1, 2026. Drift announced on that date that it had suspended all deposits and withdrawals after a malicious actor gained unauthorized access to the protocol. According to the company, the attacker took over the administrative powers of Drift’s Security Council in a highly sophisticated operation that involved the compromise of multiple multisig signers’ approvals, likely through transaction misrepresentation or targeted social engineering.

Blockchain security firm PeckShield reported that the attacker initially siphoned approximately $71 million in USDC. After converting the remainder of the stolen assets into USDC, the hacker used Circle’s cross-chain transfer protocol (CCTP) to bridge approximately $232 million in USDC from the Solana network to Ethereum. This movement occurred over a six-hour window.

Allegations of Inaction

Prominent blockchain investigator ZachXBT has argued that Circle possessed the legal tools and the opportunity to blacklist wallets and freeze the funds more rapidly to limit the losses. ZachXBT claimed that Circle’s inaction enabled the transfer of assets to Ethereum, which complicated recovery efforts.

The investigator further alleged that the Drift incident is part of a broader pattern, accusing Circle of failing to freeze USDC in 15 separate incidents involving alleged illicit activity. These cases reportedly total over $420 million in stolen funds.

One such example cited was the Cetus Protocol exploit in May 2025, which involved $223 million in stolen USDC. Reports indicate that Circle did not freeze those funds for a month, allowing the attacker to convert the assets into Ethereum.

Circle’s Legal Position

Circle has defended its actions by citing the legal constraints placed upon regulated financial entities. A company spokesperson stated that Circle is a regulated company that complies with law enforcement orders, sanctions, and court-mandated requirements.

Circle is a regulated company that complies with sanctions, law enforcement orders, and court-mandated requirements. We freeze assets when legally required, consistent with the rule of law and with strong protections for user rights and privacy.

Circle spokesperson

Legal experts have noted that freezing assets without a formal court order or law enforcement request could expose Circle to significant legal liability. This has created a tension for regulated stablecoin issuers who must balance the desire to curb illicit flows in real-time with the need to avoid legal overreach.

Current Status of Drift Protocol

As of April 3, 2026, Drift remains paused until further notice due to the irregular activity in the protocol. On April 2, 2026, Drift stated that it had identified parties related to the exploit and was sending on-chain messages to the wallets holding the stolen funds.

The company informed its community that further updates would be provided once third-party attributions are completed. The scale of the theft, estimated at $285 million, has led blockchain data analysts to suggest this could be one of the largest hacks in the history of cryptocurrency.