Drift Hack Victims Sue Circle Over Failure to Freeze $280 Million in Stolen USDC

Drift Protocol is a major decentralized perpetual futures exchange in the Solana ecosystem, allowing users to deploy assets in trading, lending and vaults. The attack was not simply a smart-contract exploit but a prolonged infiltration targeting governance multisig controls and trust in personnel. More than half of the protocol's total value locked was affected, highlighting operational security risks in DeFi.

On April 1, 2026, the attackers seized control of Drift's multisig and transferred assets within 10 seconds. The loss estimate was raised from an initial range of $136 million to $220 million to $285 million, including $155.6 million in JLP, while DRIFT fell more than 30%. Drift said on April 5 that UNC4736, a North Korea-linked group, had posed as a quantitative trading firm since the fall of 2025, infiltrating the protocol for six months and using Durable Nonce to bypass its multisig.

Circle issues the U.S. dollar stablecoin USDC and can blacklist addresses and freeze assets, while its Cross-Chain Transfer Protocol (CCTP) enables cross-chain USDC transfers. On-chain investigator ZachXBT questioned why Circle failed to intervene promptly in the hack despite having quickly frozen other wallets, accusing it of applying a double standard in enforcement.

Drift Protocol lost about $285 million on April 1, 2026. Within six hours, the attacker moved about $230 million in USDC through CCTP in more than 100 transactions. On April 3, ZachXBT accused Circle of failing to block more than $420 million in illicit funds since 2022. Investors filed a class-action lawsuit in federal court in Massachusetts on April 14.