Circle’s Nap Time: $285M Stolen USDC Party While They Snoozed

by

So, ZachXBT, the Sherlock Holmes of blockchain, is calling out Circle for basically taking a nap while millions in stolen USDC were having a field day on their cross-chain bridge during the Drift Protocol heist. Nice work, guys. Really earning that paycheck.

This all went down on April 1, which, let’s be honest, feels like the universe’s way of saying, “April Fools on you, DeFi!” The Solana-based Drift Protocol got hit for a cool $285 million, making it the biggest DeFi exploit of 2026 so far. Congrats, I guess?

Circle’s CCTP: The Turnstile for Thieves

Drift Protocol, a perpetual futures platform on Solana (SOL), got drained harder than my bank account after a weekend in Vegas. PeckShield and Arkham Intelligence flagged $285 million in outflows to attacker-controlled wallets. Because nothing says “security” like a vault that’s easier to crack than a piñata at a five-year-old’s birthday party.

#PeckShieldAlert Drift Protocol @DriftProtocol got robbed blind, losing over $285M – more than half its TVL. $DRIFT tanked by -37%.

The thief already bridged the loot from #Solana to #Ethereum via Circle’s CCTP. Smooth criminal, indeed.

– PeckShieldAlert (@PeckShieldAlert) April 2, 2026

The attacker moved the stolen USDC across wallets like it was a game of hot potato, then bridged it from Solana to Ethereum using Circle’s Cross-Chain Transfer Protocol (CCTP). Because why not? Circle was clearly busy counting sheep.

ZachXBT pointed out that all this happened during U.S. business hours. You know, when most people are at their desks pretending to work. Circle? Apparently on a coffee break that lasted hours.

“Circle was asleep while millions of USDC were swapped via CCTP during US hours. Meanwhile, I was here, sipping my coffee, watching the whole thing unfold. Thanks for the entertainment, guys.”

– ZachXBT

Specter, another security researcher, chimed in, basically saying the attacker was so confident Circle wouldn’t freeze the funds that they took their sweet time swapping the USDC. “Circle’s inaction? More like Circle’s invitation,” he quipped.

“I was fuming watching the attacker use USDC like it was Monopoly money. They held it for hours, clearly knowing Circle wouldn’t lift a finger. Meanwhile, I’m here, stress-eating my lunch.”

– Specter (@SpecterAnalyst) April 2, 2026

Circle’s Freeze Policy: Inconsistent at Best, Hypocritical at Worst

Here’s the kicker: just days before the Drift exploit, Circle froze the USDC balances of 16 unrelated business wallets as part of some civil case. Exchanges, casinos, payment processors-all left high and dry. ZachXBT called it the most incompetent move he’d seen in five years. Ouch.

“Circle froze 16 wallets for a civil case but let $285M in stolen USDC slide. Priorities, people. Priorities.”

– BeInCrypto (@beincrypto) March 24, 2026

Circle eventually unfroze one wallet linked to Goated.com, but most remained locked. So, they’re quick to freeze legitimate businesses but slow to act on a nine-figure heist? Makes perfect sense. Not.

ZachXBT also brought up Circle’s proposed optional privacy features on their Arc blockchain, suggesting it’s just another way for them to dodge accountability. “Can’t freeze what you can’t see,” he joked. Or maybe he wasn’t joking.

What’s Next for Circle and Drift?

On the Ethereum side, the stolen assets were swapped for about 129,000 ETH. Drift’s TVL dropped from $550 million to $247 million, and its DRIFT token took a 28% nosedive. Rough day at the office.

Circle hasn’t responded to the criticism. Shocking. The incident has reignited the debate over whether centralized stablecoin issuers should even have freeze authority if they’re going to use it like a kid with a freeze ray-randomly and inconsistently.

Read More

2026-04-02 08:46