The $285 million attack tied to Drift has pushed Circle’s USDC control powers into the spotlight. The core question is direct: whether the stablecoin issuer could have acted, and whether it should have moved faster once the incident unfolded.
Blockchain investigator ZachXBT was among the figures pressing that point. He argued that with so much value locked across DeFi, Circle should offer stronger support in major crisis situations. Under its terms of use, Circle can blacklist wallet addresses suspected of illicit activity and freeze associated USDC balances. That authority was already known. What changed is the intensity of scrutiny around how and when it should be used.
Freeze powers may limit attacker options, but not without risk
Some voices in the industry say timely freezes on wallets connected to a large exploit could sharply reduce an attacker’s room to move funds or cash out. In that view, intervention is a practical containment tool, especially when speed matters most.
Others see a legal trap. If Circle acts on its own, without a court order or a formal request from law enforcement, it could expose itself to lawsuits or other liability from affected users. For a centralized stablecoin issuer, the issue is not just technical capacity. It is a collision between compliance, legal exposure, and a response window that may last only minutes.
Calls grow for legal protection when issuers act on reasonable grounds
Salman Banei, general counsel at Plume, said digital asset issuers should have liability protection when they freeze suspicious transactions based on reasonable justification. His view centers on the lack of clear legal standards for these moments, where hesitation and action both carry costs.
Banei said, “Lawmakers should provide liability protection for digital asset issuers who, after reasonable assessment, intervene when they believe an illicit transfer has occurred.” The comment shifts the discussion beyond Circle alone. It points to a wider gap in policy for centralized token issuers handling live security incidents.
USDC’s programmability is now part of the dispute
The incident has also revived a broader argument about stablecoins such as USDC. These tokens are issued by centralized, regulated entities and can be designed to permit or restrict certain actions. That makes them useful for global transfers and crypto trading, but it also means their control features become controversial each time a major theft or exploit surfaces.
Blockchain analysis firms have reported possible links between the Drift incident and North Korean-affiliated hacker groups. Because tokens like USDC can technically be monitored or frozen when authorities request it, many market participants expect issuers to respond in serious cases. At the same time, there is clear concern that those powers could be stretched too far or used too often.
Bluechip says the case is more complex than a standard hack
Ben Levit, founder and CEO of stablecoin rating agency Bluechip, said the assumption that Circle simply should have stepped in misses the complexity of the event. He argued that what happened was not a conventional hack, but a manipulation of market and oracle mechanisms, leaving Circle’s options tied more to internal judgment than to any bright-line regulatory duty.
Levit said, “Assuming that Circle should step in is an oversimplification. What happened wasn’t a typical hack, but rather the manipulation of market and oracle mechanisms. So, Circle’s choices are based more on internal judgment than on any absolute regulatory requirement.”
He also said the absence of clear policy is especially problematic when USDC is presented as neutral market infrastructure. Move too slowly, and an issuer may be accused of enabling illicit activity. Move too quickly, and it may face claims of overreach or legal breach. In fast-moving attacks, that decision window can close within minutes.