Key Takeaways
- Cybercriminals extracted $285 million from the Drift crypto protocol, transferring $232 million in USDC between blockchains via Circle’s Cross-Chain Transfer Protocol
- On-chain detective ZachXBT criticized Circle for not acting swiftly to freeze stolen assets during the breach
- Circle maintains it exclusively freezes funds when mandated by legal authorities or court orders
- According to ZachXBT, Circle has neglected to freeze $420 million in stolen USDC across 15 incidents dating back to 2022
- Legal analysts caution that freezing digital assets without proper legal backing could leave Circle vulnerable to lawsuits
The firm responsible for issuing USDC, Circle, finds itself under intense scrutiny following its response to this week’s $285 million breach of the Drift protocol.
The perpetrator directly siphoned approximately $71 million in USDC from Drift. Following the conversion of most other stolen digital assets into USDC, the criminal deployed Circle’s Cross-Chain Transfer Protocol (CCTP) to shuttle roughly $232 million in USDC from the Solana network to Ethereum.
This cross-chain movement significantly complicated asset recovery efforts. It simultaneously thrust Circle into a controversial position.
Prominent blockchain sleuth ZachXBT emerged as a particularly vocal detractor. He contended that Circle possessed the technical capability to blacklist addresses and immobilize funds but failed to execute these measures promptly during the security breach.
“Why should crypto businesses continue to build on Circle when a project with nine-figure TVL could not get support during a major incident?” he posted on X.
Circle’s Official Response
Circle issued a firm rebuttal to these allegations. A company representative informed CoinDesk that as a regulated entity, Circle exclusively freezes digital assets when legally mandated, including situations involving court directives or formal law enforcement requests.
“We freeze assets when legally required, consistent with the rule of law and with strong protections for user rights and privacy,” the spokesperson said.
Salman Banei, who serves as general counsel for tokenized asset platform Plume, endorsed Circle’s stance. He emphasized that immobilizing funds absent formal legal authorization could subject stablecoin issuers to significant legal exposure. He advocated for legislative action to establish legal safe harbor provisions enabling issuers to respond more rapidly in unambiguous theft scenarios.
Not everyone in the cryptocurrency sector views this incident through a simple lens. Ben Levit, who leads stablecoin evaluation firm Bluechip as CEO, characterized the Drift exploit as primarily involving market and oracle manipulation rather than a conventional hack, positioning it within murky legal territory.
“Any action by Circle becomes a judgment call, not just a compliance decision,” Levit said.
Investigator Claims Systematic Failures
ZachXBT expanded his criticism, releasing comprehensive allegations that Circle has neglected to freeze or blacklist approximately $420 million in illicit USDC transactions spanning 15 distinct incidents since 2022.
Within these documented cases, he alleges Circle didn’t freeze $9 million following the GMX exchange compromise in July 2025, and that addresses connected to the $200 million Cetus DEX breach were only blacklisted after perpetrators had already exchanged the funds for other cryptocurrencies.
He emphasized the $420 million estimate exclusively encompasses prominent public incidents and suggested the actual aggregate is substantially higher.
Circle had previously investigated “reversible” USDC transaction capabilities in September 2025, a functionality that would enable fund reversals in theft situations. The organization has historically frozen USDC, including assets associated with Tornado Cash addresses sanctioned by US authorities in 2022.
Cybersecurity researchers specializing in blockchain analysis have attributed the Drift exploitation to threat actors affiliated with North Korea’s state apparatus.


