TL;DR - Circle did not freeze a cent of the $232 million in stolen USDC that moved through its own bridge during the April 2026 Drift Protocol hack.
On April 1, 2026, an exploiter drained roughly $285 million from the Solana lending protocol Drift and converted $232 million of it into USDC, then bridged the funds to Ethereum through Circle's own Cross-Chain Transfer Protocol across more than 100 transactions over six consecutive hours. Circle didn't touch it.
Most posts about stablecoin freezes cover the wallets that get blocked by mistake. This one covers the money that didn't get blocked at all, and what that gap means if your wallet is anywhere downstream of it.
What happened during the Drift Protocol hack?
Drift is a Solana-based lending and perpetuals protocol. On April 1, 2026, an attacker exploited it for close to $285 million. A large share of the haul, about $232 million, was USDC, and the attacker moved it off Solana using CCTP, Circle's own official cross-chain rail, in over 100 separate transactions spread across roughly six hours during U.S. business hours.
Six hours is a long window to do nothing. Blockchain analytics firm Elliptic later attributed the exploit to North Korea's Lazarus Group, the same actors tied to a long string of DeFi hacks screened wallets keep turning up in.
Why didn't Circle freeze the stolen USDC?
Circle's public position is that its blacklist function is a compliance instrument, not a discretionary emergency brake. CEO Jeremy Allaire said the company freezes USDC only when directed by law enforcement or a court, not in real time while an exploit is in progress. In comments reported by The Block, Allaire described the decision not to act during the Drift hack as a "moral quandary," arguing that letting compliance staff freeze funds on their own judgment during a live incident would set a precedent he wasn't willing to create.
That capability is real. Circle blacklisted more than 75,000 USDC tied to Tornado Cash wallets back in 2022, within hours of the OFAC sanctions designation. A government order moves Circle fast. An active hack, on its own, apparently doesn't.
How does this compare with Tether, or with Circle's other freezes?
The contrast gets sharper next to Tether. Public reporting puts Tether's cumulative freezes at roughly $5.7 billion across about 9,600 addresses, against Circle's roughly $109 million across 372 addresses over 2023 to 2025. Tether moves on its own timeline, without waiting for a court order. Circle waits.
Tether has frozen over 50 times more USDT value than Circle has frozen in USDC, spread across roughly 26 times as many addresses.
Barely three weeks before the Drift hack, Circle froze 16 unrelated business wallets over a sealed civil case with no visible link between them - a decision on-chain investigator ZachXBT called one of the most incompetent freezes he'd documented in five years. ZachXBT has separately tallied more than $420 million in illicit USDC flows across 15 cases since 2022 that Circle didn't freeze promptly. Fast against innocent wallets. Slow against real theft.
What does this mean if your wallet touched the Drift hack funds?
The stolen USDC didn't disappear. CCTP is a public, traceable rail, and every hop the exploiter made is sitting on Ethereum and Solana for anyone to read. A wallet several hops downstream from those funds carries stolen-funds exposure regardless of whether Circle ever blacklists the address at the source. A class-action suit filed in federal court in Massachusetts already accuses Circle of failing to act on the Drift funds in time, which means Circle's own legal exposure here is still unresolved.
Anyone can pull up a wallet's inbound transfers on Etherscan and manually check them against known exploiter addresses, one transaction at a time. Screening a wallet with Plastron does that automatically, checking sanctions, mixer, and stolen-funds exposure across Ethereum and six other chains in a single pass, the same category of exposure covered in our bridge-hack exposure breakdown.
Should you wait for an issuer to freeze funds before you act?
No. Plastron's own screening dataset runs independently of any issuer's freeze decision: 3,901 labeled high-risk addresses across scam, fraud, and hack-exploit categories, cross-checked against the full 780-address OFAC SDN list. That check runs the same way whether Circle ever blacklists the Drift exploiter's wallets or not.
A stablecoin issuer's freeze button is a legal instrument, not a safety net for your wallet. Circle's own six-hour gap proves the point: the money was traceable in real time, and it moved anyway.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.
About Plastron
Plastron is a free, non-custodial wallet screening tool. It checks Ethereum and six EVM chains for AML and KYT risk — sanctions exposure, mixer contact, and stolen-funds proximity — and returns a risk report in seconds. It reads public on-chain data only: it never takes custody of funds and never asks for private keys.
