Circle took no action while a hacker moved millions in stolen USDC through its own cross-chain bridge during US business hours, raising serious questions about when and why the issuer exercises its freeze authority.
The largest DeFi exploit of 2026 exposed more than just a vulnerability in Drift Protocol's vaults. It revealed a troubling inconsistency in how Circle, the company behind USDC, enforces its power to freeze funds. On April 1, an attacker drained roughly $285 million from the Solana-based perpetual futures exchange. The stolen assets, heavily denominated in USDC, were bridged from Solana to Ethereum using Circle's own Cross-Chain Transfer Protocol. The transfers happened during US business hours. Nobody at Circle pressed stop.
Onchain investigator ZachXBT was among the first to flag the inaction, pointing out that millions of dollars in stolen stablecoins moved through Circle's infrastructure for hours with zero intervention. Security researcher Specter noted something even more telling: the attacker held USDC across multiple wallets for one to three hours before swapping, deliberately avoiding conversion to Tether's USDT during the bridging process. That choice suggests the hacker was confident Circle would not freeze the funds. The confidence was warranted.
What makes this silence so frustrating for the crypto community is what Circle was doing just days earlier. On March 23, the issuer froze USDC balances across 16 hot wallets tied to a sealed US civil case. Those wallets belonged to exchanges, casinos, and payment processors. ZachXBT called it potentially the most incompetent freeze he had witnessed in over five years, arguing that onchain analysis showed the wallets were engaged in legitimate activity. Circle later unfroze one wallet linked to Goaled.com, but most remained locked.
The contrast is difficult to ignore. When presented with a civil matter involving businesses conducting what appeared to be normal operations, Circle acted swiftly and broadly. When confronted with a confirmed nine-figure theft from a DeFi protocol, where stolen funds transited its own bridging infrastructure in plain sight, the company did nothing. That discrepancy cuts to the heart of a long-running debate in crypto: centralized stablecoin issuers wield enormous power over the ecosystem, but the application of that power appears arbitrary, unpredictable, and potentially influenced by legal pressure rather than consistent principles.
For founders building on stablecoin infrastructure, this matters deeply. If Circle freezes your treasury because of a sealed court filing you cannot see or respond to, your operations halt. If a hacker steals your users' funds and routes them through Circle's own bridge, apparently no one will intervene. You cannot plan around that kind of enforcement. You can only hope you are not next in the crosshairs.
What the Market Is Telling Us
The damage to Drift was immediate and severe. The protocol's total value locked collapsed from approximately $550 million to $247 million, a drop of more than half. The native DRIFT token fell nearly 28 percent. On the Ethereum side, the attacker had already swapped stolen assets into roughly 129,000 ETH, making recovery increasingly unlikely as those funds are laundered through mixers or decentralized exchanges.
Circle has not publicly responded to the criticism. But the incident has reignited a conversation that will not fade quietly. Stablecoin issuers market their products as neutral settlement layers for the decentralized economy. Yet USDC and USDT both operate under terms that grant their issuers unilateral freeze authority, a feature designed to comply with law enforcement requests and court orders. The problem is not that this authority exists. Compliance with legal processes is reasonable and expected. The problem is that its application seems to depend more on who is asking than on what happened.
ZachXBT also connected this incident to Circle's upcoming Arc blockchain, which proposes optional privacy features that could limit transaction visibility. If Circle struggles to act on obviously stolen funds moving through its current transparent infrastructure, reducing onchain observability could make accountability even harder to enforce.
For investors and builders, the takeaway is straightforward. Stablecoins remain the backbone of DeFi liquidity, but the centralized issuers behind them are not neutral utility providers. They are gatekeepers with legal obligations, commercial incentives, and enforcement patterns that do not always align with the interests of the protocols that depend on them. Watch how Circle responds in the coming days. Watch whether Drift can recover. And watch whether this incident finally pushes more DeFi protocols to explore truly decentralized alternatives for settlement, or at least to diversify their stablecoin exposure so a single issuer's decisions cannot wipe out half their TVL overnight.
