- TVL decreased from $311.38 million to $23.49 million inside hours, with as much as $285 million leaked by means of the drift exploit.
- USDC migrated from Solana to Ethereum through CCTP with none suspension or freeze.
- Based on ZachXBT, Circle froze 16 wallets final week however took no motion throughout the hack.
On April 1, 2026, throughout enterprise hours in america, a large-scale exploit occurred on Drift Protocol. The assault resulted in losses of $285 million, the Complete Worth Locked (TVL) plummeted from $311.38 million to $23.49 million, and the protocol’s liquidity collapsed by 92.5% inside hours.
The attackers shortly consolidated and exchanged their property into USDC and SOL, with USDC being bridged to Ethereum through Circle’s CCTP over a number of hours.
On-chain researcher ZachXBT flagged this transfer in actual time. His argument was that Circle did not act.
CCTP handles transfers with out friction
CCTP works by writing USDC on the supply chain and minting it on the vacation spot chain. The system processed 9 orders of magnitude flows associated to the exploit.
There have been no pauses, freezes, or handbook critiques. ZachXBT stated Circle detected nothing and took no motion, pointing to an absence of oversight on the protocol stage.
The issue wasn’t technical complexity; the flows have been massive, speedy, and weird. They nonetheless handed. This highlights a spot as cross-chain infrastructure handles transfers as supposed however lacks enforcement mechanisms.
Earlier pockets freeze raised questions
That is in distinction to a earlier motion wherein Circle mistakenly froze greater than 16 business-related wallets. These wallets are nonetheless within the technique of being unfrozen.
Though the issuer was the identical, the measures taken have been totally different. Market members famous the discrepancy. One particular person identified that whereas Circle was in a position to freeze inner wallets, it was unable to cease a nine-figure exploit circulation by means of CCTP.
The Drift exploit was executed throughout energetic hours when the monitoring staff was on-line. Nonetheless, no motion was taken, and market members expressed disappointment.
Associated: DeFi hacks to prime $137 million in early 2026 as safety failures improve
Disclaimer: The data contained on this article is for informational and academic functions solely. This text doesn’t represent monetary recommendation or recommendation of any type. Coin Version shouldn’t be liable for any losses incurred on account of the usage of the content material, merchandise, or providers talked about. We encourage our readers to do their due diligence earlier than taking any motion associated to our firm.