On April 1, 2026, Solana-based derivatives protocol Drift Protocol suffered a $286 million exploit, marking the largest DeFi hack of the year. Blockchain analytics firms Elliptic and TRM Labs attributed the attack to North Korea's Lazarus Group, which infiltrated Drift's Security Council through AI-assisted social engineering over six months.
100 Transactions, U.S. Business Hours, Tornado Cash
The hacker executed over 100 transactions during U.S. business hours via Circle's Cross-Chain Transfer Protocol (CCTP), bridging approximately $230 million USDC from Solana to Ethereum over several hours — with Circle taking no action. Once on Ethereum, the attacker swapped USDC for ETH and laundered funds through the privacy protocol Tornado Cash.
Core of the Lawsuit: Circle Could Freeze but Didn't
According to CoinTelegraph, Drift investor Joshua McCollum filed a class action in Massachusetts federal court on behalf of over 100 victims, charging Circle with “aiding unlawful misappropriation” and negligence. Law firm Gibbs Mura argued in the complaint that Circle allowed criminal misuse of its technology and that timely action could have prevented or drastically reduced losses. The lawsuit highlights that just nine days before the Drift hack, Circle had frozen 16 USDC wallets in response to a sealed U.S. civil case — proving it had the technical ability but chose not to intervene.
Circle CEO: Freezing Requires a Court Order
CoinTelegraph didn't receive immediate comment from Circle. CEO Jeremy Allaire earlier stated the firm wouldn't unilaterally freeze funds without a court order and called for clearer legal frameworks via the Clarity Act. ARK Invest's digital asset research director Lorenzo Valente defended Circle: "Every freeze Circle executes becomes a subjective judgment; every failure to freeze is interpreted as a political stance." He added that whether Circle acted correctly depends on balancing rule-of-law principles against specific harm — reasonable people can disagree.
Drift Switches to USDT
Blockchain detective ZachXBT criticized Circle, noting that since 2022 Circle has allowed over $420 million in illicit funds to flow, questioning its freeze mechanism. Meanwhile, Drift Protocol announced it would switch its settlement stablecoin from USDC to USDT, with Tether committing $127.5 million as a rescue fund.