Circle is under fire for failing to freeze stolen USDC following the $285 million Drift attack.
Faster action by Circle, according to well-known blockchain investigator ZachXBT, would have reduced cryptocurrency losses, but blocking assets without permission entails legal dangers.
According to blockchain security company PeckShield, the attacker used the bug on Wednesday to siphon out about $71 million in USDC. The hacker utilized Circle's cross-chain transfer protocol, CCTP, to bridge roughly $232 million in USDC from Solana to Ethereum after converting the majority of the remaining stolen assets to USDC. This made recovery attempts more challenging.
Some in the cryptocurrency industry have criticized that movement, including well-known blockchain investigator ZachXBT, who claimed Circle might have taken quicker action to lessen the harm.
He wrote in an X post after the attack, "Why should crypto firms continue to expand on Circle when a project with 9 fig[ure] TVL [total value locked] could not get support during a significant incident?
ZachXBT noted that the corporation had resources at its disposal. Circle retains the right, on its own terms, to freeze USDC associated with any suspicious activity and to blacklist addresses.
One creator of a stablecoin infrastructure company told CoinDesk that preemptively freezing wallets connected to the bug would have hampered or prevented the attacker's ability to transfer money.
But responding without a court order or a request from law enforcement might put Circle in legal jeopardy, the individual continued.
According to Salman Banei, general counsel of the tokenized asset network Plume, issuers may be held liable if assets are frozen without official authorization. He contended that regulators ought to close that legal loophole."If digital asset issuers freeze assets when, in their reasonable judgment, there is strong basis to believe that illicit transfers have occurred, lawmakers should provide a safe harbor from civil liability," stated Banei.
The company's reaction revolved around that restriction.
In a statement to CoinDesk, a representative stated, "Circle is a regulated firm that complies with fines, law enforcement directives, and court-mandated procedures. "In accordance with the rule of law and with robust safeguards for user rights and privacy, we freeze assets when legally mandated."
The episode draws attention to a deeper tension that is becoming more and more apparent as stablecoins gain popularity.
Global money flows are increasingly reliant on tokens like USDC, particularly for cross-border trade and payments. They are also utilized in illegal activity, which puts pressure on issuers to take swift action when something goes wrong.
About $141 billion in stablecoin transactions in 2025 were connected to illegal conduct, including as money laundering and sanctions evasion, according to TRM Labs.
North Korean hackers are most likely responsible for the Drift exploit, according to blockchain security companies.
The programmable and controllable nature of stablecoins produced by centralized, regulated organizations, such as Circle's USDC, can assist prevent illegal movements, but it may also give rise to questions about due process and overreach.
The CEO and founder of stablecoin grading company Bluechip, Ben Levit, states that "the situation isn't that clear-cut in the instance of the Drift exploit. He said, "I think this is being framed too simplistically as Circle should've frozen." This was a market/oracle exploit rather than a clean hack, which places it in a gray area.
"Thus, Circle's actions become a judgment call rather than merely a compliance decision," he continued.
Consistency is more significant to him. "According to Levit, USDC cannot be positioned as neutral infrastructure while allowing for discretionary action in the absence of clear regulations. Markets can manage strict regulations or no intervention, but price ambiguity is far more challenging.
This puts issuers in a challenging situation. Acting too soon without legal support raises concerns about overreach, while moving too slowly runs the danger of being accused of supporting bad actors.
With the window of opportunity to intervene frequently measured in minutes rather than weeks or months of judicial proceedings, this trade-off becomes particularly obvious in fast-moving adventures.
Faster action by Circle, according to well-known blockchain investigator ZachXBT, would have reduced cryptocurrency losses, but blocking assets without permission entails legal dangers.
- The attacker used Circle's cross-chain transfer protocol to transfer over $232 million in USDC from Solana to Ethereum after taking advantage of the cryptocurrency protocol Drift.
- Blockchain investigator ZachXBT and other critics said that Circle might have acted more quickly to freeze assets along with blacklist wallets. However, Plume general counsel stated that freezing assets without permission could result in legal jeopardy.
- Circle stated that it freezes assets when legally necessary, underscoring the increasing conflict for regulated issuers between taking prompt action to stop illegal movements and refraining from going too far without court or law enforcement orders.
According to blockchain security company PeckShield, the attacker used the bug on Wednesday to siphon out about $71 million in USDC. The hacker utilized Circle's cross-chain transfer protocol, CCTP, to bridge roughly $232 million in USDC from Solana to Ethereum after converting the majority of the remaining stolen assets to USDC. This made recovery attempts more challenging.
Some in the cryptocurrency industry have criticized that movement, including well-known blockchain investigator ZachXBT, who claimed Circle might have taken quicker action to lessen the harm.
He wrote in an X post after the attack, "Why should crypto firms continue to expand on Circle when a project with 9 fig[ure] TVL [total value locked] could not get support during a significant incident?
ZachXBT noted that the corporation had resources at its disposal. Circle retains the right, on its own terms, to freeze USDC associated with any suspicious activity and to blacklist addresses.
One creator of a stablecoin infrastructure company told CoinDesk that preemptively freezing wallets connected to the bug would have hampered or prevented the attacker's ability to transfer money.
But responding without a court order or a request from law enforcement might put Circle in legal jeopardy, the individual continued.
According to Salman Banei, general counsel of the tokenized asset network Plume, issuers may be held liable if assets are frozen without official authorization. He contended that regulators ought to close that legal loophole."If digital asset issuers freeze assets when, in their reasonable judgment, there is strong basis to believe that illicit transfers have occurred, lawmakers should provide a safe harbor from civil liability," stated Banei.
The company's reaction revolved around that restriction.
In a statement to CoinDesk, a representative stated, "Circle is a regulated firm that complies with fines, law enforcement directives, and court-mandated procedures. "In accordance with the rule of law and with robust safeguards for user rights and privacy, we freeze assets when legally mandated."
The episode draws attention to a deeper tension that is becoming more and more apparent as stablecoins gain popularity.
Global money flows are increasingly reliant on tokens like USDC, particularly for cross-border trade and payments. They are also utilized in illegal activity, which puts pressure on issuers to take swift action when something goes wrong.
About $141 billion in stablecoin transactions in 2025 were connected to illegal conduct, including as money laundering and sanctions evasion, according to TRM Labs.
North Korean hackers are most likely responsible for the Drift exploit, according to blockchain security companies.
The programmable and controllable nature of stablecoins produced by centralized, regulated organizations, such as Circle's USDC, can assist prevent illegal movements, but it may also give rise to questions about due process and overreach.
The CEO and founder of stablecoin grading company Bluechip, Ben Levit, states that "the situation isn't that clear-cut in the instance of the Drift exploit. He said, "I think this is being framed too simplistically as Circle should've frozen." This was a market/oracle exploit rather than a clean hack, which places it in a gray area.
"Thus, Circle's actions become a judgment call rather than merely a compliance decision," he continued.
Consistency is more significant to him. "According to Levit, USDC cannot be positioned as neutral infrastructure while allowing for discretionary action in the absence of clear regulations. Markets can manage strict regulations or no intervention, but price ambiguity is far more challenging.
This puts issuers in a challenging situation. Acting too soon without legal support raises concerns about overreach, while moving too slowly runs the danger of being accused of supporting bad actors.
With the window of opportunity to intervene frequently measured in minutes rather than weeks or months of judicial proceedings, this trade-off becomes particularly obvious in fast-moving adventures.