Onchain investigator ZachXBT accused Circle of failing to act while millions in stolen USDC moved freely through its own cross-chain bridge during the $285 million Drift Protocol exploit.

The criticism followed the April 1 attack on the Solana-based decentralized exchange, which ranks as the largest DeFi exploit of 2026 so far.

Circle Faces Backlash Over CCTP Inaction

Drift Protocol, a perpetual futures platform on Solana (SOL), suffered a massive vault drain on April 1. Security firm PeckShield and blockchain analytics platform Arkham Intelligence flagged roughly $285 million in outflows from Drift’s main vault to attacker-controlled wallets.

The attacker moved stolen assets, heavily involving USDC, across multiple wallets before bridging them from Solana to Ethereum using Circle’s Cross-Chain Transfer Protocol (CCTP).

ZachXBT pointed out the transfers occurred during U.S. business hours with no intervention.

Circle was asleep while many millions of USDC were swapped via CCTP from Solana to Ethereum for hours from the 9-figure Drift hack during US hours,” the blockchain investigator stated.

Security researcher Specter echoed those concerns. He noted that the attacker held USDC across wallets for 1 to 3 hours before swapping and deliberately avoided converting to Tether (USDT) during the bridging process, suggesting confidence that Circle would not freeze the funds.

A Pattern of Contradictory Responses

The timing intensified frustration. Just days before the Drift exploit, Circle froze the USDC balances of 16 unrelated business hot wallets on March 23, as part of a sealed U.S. civil case.

That action disrupted operations for exchanges, casinos, and payment processors.

ZachXBT previously called that freeze potentially the most incompetent he had seen in over five years. He argued that, based on on-chain analysis, the wallets engaged in legitimate activity.

Circle later unfroze one wallet linked to Goated.com on March 26, but most remained locked.

The contrast is stark. Circle acted aggressively on a civil matter affecting legitimate businesses. Yet during a confirmed nine-figure exploit, it took no steps to freeze stolen funds transiting its own infrastructure.

ZachXBT also tied this behavior to Circle’s proposed optional privacy features on its upcoming Arc blockchain. He suggested those features could reduce compliance accountability further by limiting who can view transactions.

What Comes Next for Circle and Drift

On the Ethereum side, stolen assets were swapped for roughly 129,000 ETH. Drift’s total value locked collapsed from approximately $550 million to $247 million, and its native DRIFT token fell nearly 28%.

Circle has not publicly responded to the criticism. The incident has reignited debate over whether centralized stablecoin issuers can justify their freeze authority if they apply it inconsistently.

The post ZachXBT Slams Circle for Letting Millions in Stolen USDC Flow Freely After Drift Hack appeared first on BeInCrypto.

Source link