{"id":8095,"date":"2026-04-03T17:43:50","date_gmt":"2026-04-03T17:43:50","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=8095"},"modified":"2026-04-03T17:43:50","modified_gmt":"2026-04-03T17:43:50","slug":"circle-faces-fury-after-230-million-in-stolen-usdc-crossed-its-bridge","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=8095","title":{"rendered":"Circle faces fury after $230 million in stolen USDC crossed its bridge"},"content":{"rendered":"

<\/p>\n

\n

Stablecoin issuer Circle is facing mounting scrutiny from blockchain researchers after millions of USD Coin (USDC) were stolen and flowed unimpeded through its proprietary bridge during the $285 million exploit of the Solana-based Drift Protocol.<\/p>\n

The inaction during the April 1 attack, which is now the largest decentralized finance (DeFi) hack of 2026, stands in stark contrast to Circle\u2019s aggressive asset freeze tied to a sealed US civil case just days prior.<\/p>\n

This juxtaposition has reignited debate over the responsibilities and inconsistencies of centralized stablecoin issuers operating within permissionless markets.<\/p>\n

According to on-chain investigator ZachXBT, the attackers bridged more than $230 million in USDC from Solana to Ethereum across over 100 transactions using Circle\u2019s Cross-Chain Transfer Protocol (CCTP).<\/p>\n

\"Drift\"Drift
Drift Exploit Transaction Tracing (Source: Elliptic)<\/figcaption><\/figure>\n

Why this matters:<\/strong> The episode highlights a structural tension in crypto markets: stablecoins like USDC operate inside permissionless systems but retain centralized control. When that control is applied inconsistently, it raises new risks for users, protocols, and regulators trying to understand where intervention will, or will not, occur during a crisis.<\/em><\/p>\n

The transfers occurred over several hours during the US business day, giving the New York-headquartered issuer ample time to intervene.<\/p>\n

This view was corroborated by other security experts, who noted that the attacker held stolen USDC across multiple wallets for one to three hours before bridging to Ethereum.<\/p>\n

The hacker notably avoided converting the funds to Tether’s USDT, suggesting a calculated bet that Circle would not deploy its smart-contract blacklist authority.<\/p>\n

That bet paid off because USDT is the largest stablecoin by market capitalization, and its issuer is renowned for blacklisting malicious attackers using its asset to shift funds.<\/p>\n

\n
\"Tether\"Tether<\/div>\n
Related Reading<\/span><\/p>\n

Tether reportedly puts FTX’s $46M in USDT on ice<\/h3>\n

Reports revealed that the seizure was carried out following orders of law enforcement agencies.<\/p>\n

Nov 10, 2022<\/span> \u00b7<\/span> Oluwapelumi Adejumo<\/span><\/p>\n<\/div><\/div>\n

The civil contrast<\/h2>\n

The timing of the exploit has intensified the backlash. On March 23, Circle froze the USDC balances of 16 unrelated corporate hot wallets and disrupted legitimate exchanges, casinos, and payment processors in response to a civil dispute.<\/p>\n

ZachXBT previously characterized that action as \u201cpotentially the single most incompetent\u201d freeze he had witnessed in five years.<\/p>\n

Critics are now asking a fundamental question: If Circle claims the authority to freeze assets to enforce compliance, why does it apply that power aggressively against legitimate businesses while ignoring a confirmed, nine-figure heist transiting its own infrastructure?<\/p>\n

However, Santisa, the pseudonymous CIO of investment firm Lucidity Cap, argued the opposite. He stated:<\/p>\n

\n

\u201cCircle not blacklisting is actually quite cypherpunk of them, no matter the reason. The industry pushing for active blacklisting puts us ever further away from decentralisation \u2014 not necessarily a bad thing! Just a trade-off.\u201d<\/p>\n<\/blockquote>\n

To date, Circle has blacklisted roughly $117 million across 601 wallets, according to Dune Analytics data, showing that the capability exists.<\/p>\n

\"Circle's\"Circle's
Circle’s USDC Blacklist (Source: Dune Analytics)<\/figcaption><\/figure>\n

Anatomy of the Drift exploit<\/h2>\n

The attack on Drift, previously the cornerstone of Solana\u2019s DeFi ecosystem with over $550 million in Total Value Locked (TVL), was a highly sophisticated, weeks-long operation.<\/p>\n

According to Drift Protocol\u2019s post-mortem, the attackers compromised the protocol’s Security Council.<\/p>\n

\n
\"Drift's\"Drift's<\/div>\n
Related Reading<\/span><\/p>\n

Drift’s BET platform brings prediction markets to Solana blockchain<\/h3>\n

The Solana-based platform introduces novel features that distinguishes it from rivals in the market.<\/p>\n

Aug 19, 2024<\/span> \u00b7<\/span> Oluwapelumi Adejumo<\/span><\/p>\n<\/div><\/div>\n

On March 30, they exploited a mechanism known as a \u201cDurable Nonce\u201d to quietly gain necessary multisig approvals.<\/p>\n

\n
\n
CryptoSlate Daily Brief<\/span><\/p>\n

Daily signals, zero noise.<\/h3>\n

Market-moving headlines and context delivered every morning in one tight read.<\/p>\n

5-minute digest<\/span> 100k+ readers<\/span><\/p>\n<\/div>\n

\n

Free. No spam. Unsubscribe any time.<\/p>\n

Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n

You\u2019re subscribed. Welcome aboard.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

The durable nonce is a tool designed to keep unconfirmed transactions valid indefinitely for offline approvals. Yu Xian, the founder of blockchain security firm Slowmist, said:<\/p>\n

\n

\u201cAnother encounter with the durable nonce offline pre-signature mechanism exploit. This phishing technique has been prevalent for at least 2 years. Once such a signature is phished away, the attacker can initiate \u201clegally signed\u201d on-chain operations at a future opportune moment\u2014for instance, in the Drift scenario, it resulted in the takeover of its on-chain admin privileges.\u201d<\/p>\n<\/blockquote>\n

On April 1, the attackers shifted admin authority, initialized a fake asset called CVT, artificially inflated its value via oracle manipulation, and borrowed against the false collateral.<\/p>\n

In short order, they drained the JLP Delta Neutral, SOL Super Staking, and BTC Super Staking vaults. DefiLlama data shows Drift\u2019s TVL collapsed to under $250 million following the attack.<\/p>\n

The fallout has spread rapidly across the Solana DeFi ecosystem, considering Drift’s prominent role.<\/p>\n

According to reports, at least 20 third-party applications that relied on Drift’s vaults to generate yield have confirmed financial impact, including Prime Numbers Fi, which estimates losses exceeding $10 million.<\/p>\n

Who is behind the attack?<\/h2>\n

While the identity of the attackers remains unknown as of press time, Drift stated on X that it had identified critical information about the parties involved in the exploit.<\/p>\n

Meanwhile, security experts have noted that the sophisticated laundering methodology points to a familiar adversary of North Korean attackers.<\/p>\n

Blockchain intelligence firm Elliptic reported that the on-chain behavior and network-level indicators align with operations conducted by the Democratic People’s Republic of Korea (DPRK).<\/p>\n

Another blockchain security firm, Diverg, further stated:<\/p>\n

\n

\u201cWe can confirm along with TRM Labs and Elliptic that North Korea’s Lazarus Group (TraderTraitor) [was behind the Drift attac]. [The] same unit [was] behind Bybit’s $1.5 billion hack [and] Ronin’s $625 million attack.\u201d<\/p>\n<\/blockquote>\n

If confirmed, the Drift exploit would mark the eighteenth DPRK-linked crypto theft this year, pushing the regime’s 2026 illicit haul past $300 million.<\/p>\n

It arrives amid an escalation in state-sponsored attacks targeting crypto infrastructure, including a recent software supply chain compromise attributed by Google to the North Korean threat actor UNC1069.<\/p>\n

\n
\n
\n
Mentioned in this article<\/span><\/header>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Crime,Featured,Hacks,Stablecoins,TradFi,Trading,Circle,Drift,Solana,USDCCircle,Drift,Solana,USDC#Circle #faces #fury #million #stolen #USDC #crossed #bridge1775238230<\/p>\n","protected":false},"excerpt":{"rendered":"

Stablecoin issuer Circle is facing mounting scrutiny from blockchain researchers after millions of USD Coin (USDC) were stolen and flowed unimpeded through its proprietary bridge during the $285 million exploit of the Solana-based Drift Protocol. The inaction during the April 1 attack, which is now the largest decentralized finance (DeFi) hack of 2026, stands in<\/p>\n","protected":false},"author":1,"featured_media":8096,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[2089,1677,3780,2314,147,3779,406,152,2671,1582],"class_list":{"0":"post-8095","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-ethereum","8":"tag-bridge","9":"tag-circle","10":"tag-crossed","11":"tag-drift","12":"tag-faces","13":"tag-fury","14":"tag-million","15":"tag-solana","16":"tag-stolen","17":"tag-usdc"},"yoast_head":"\nCircle faces fury after $230 million in stolen USDC crossed its bridge - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Circle\u2019s inaction during the Drift Protocol hack highlights a critical flaw in how stablecoin issuers enforce their smart-contract authority.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=8095\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Circle faces fury after $230 million in stolen USDC crossed its bridge\" \/>\n<meta property=\"og:description\" content=\"Circle\u2019s inaction during the Drift Protocol hack highlights a critical flaw in how stablecoin issuers enforce their smart-contract authority.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=8095\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-03T17:43:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/circle-usdc-drift-protocol.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"800\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8095\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=8095\",\"name\":\"Circle faces fury after $230 million in stolen USDC crossed its bridge - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8095#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8095#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/circle-usdc-drift-protocol.jpg\",\"datePublished\":\"2026-04-03T17:43:50+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Circle\u2019s inaction during the Drift Protocol hack highlights a critical flaw in how stablecoin issuers enforce their smart-contract authority.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8095#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=8095\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8095#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/circle-usdc-drift-protocol.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/circle-usdc-drift-protocol.jpg\",\"width\":1200,\"height\":800},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8095#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Circle faces fury after $230 million in stolen USDC crossed its bridge\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Circle faces fury after $230 million in stolen USDC crossed its bridge - Crypto News: Latest Cryptocurrency News and Analysis","description":"Circle\u2019s inaction during the Drift Protocol hack highlights a critical flaw in how stablecoin issuers enforce their smart-contract authority.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=8095","og_locale":"en_US","og_type":"article","og_title":"Circle faces fury after $230 million in stolen USDC crossed its bridge","og_description":"Circle\u2019s inaction during the Drift Protocol hack highlights a critical flaw in how stablecoin issuers enforce their smart-contract authority.","og_url":"https:\/\/cryptonews.uk.com\/?p=8095","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-04-03T17:43:50+00:00","og_image":[{"width":1200,"height":800,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/circle-usdc-drift-protocol.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=8095","url":"https:\/\/cryptonews.uk.com\/?p=8095","name":"Circle faces fury after $230 million in stolen USDC crossed its bridge - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=8095#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=8095#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/circle-usdc-drift-protocol.jpg","datePublished":"2026-04-03T17:43:50+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Circle\u2019s inaction during the Drift Protocol hack highlights a critical flaw in how stablecoin issuers enforce their smart-contract authority.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=8095#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=8095"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=8095#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/circle-usdc-drift-protocol.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/circle-usdc-drift-protocol.jpg","width":1200,"height":800},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=8095#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Circle faces fury after $230 million in stolen USDC crossed its bridge"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/8095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8095"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/8095\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/8096"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}