On-chain investigator ZachXBT accused stablecoin issuer Circle of failing to act while millions in USDC (USDC) moved from Solana (SOL) to Ethereum (ETH) during the Drift Protocol exploit that drained an estimated $285M from the Solana-based perpetual futures exchange on Apr. 1.
Drift Protocol Private Key Breach
Drift Protocol confirmed in an X post that it was under active attack and had suspended all deposits and withdrawals. The platform said it was coordinating with security firms, bridges, and exchanges to contain the incident.
On-chain records show the initial transfer occurred around 11:06 a.m., when 41M JLP tokens worth $155M were moved from the Drift Vault to an external wallet.
Additional outflows followed, including SOL, stablecoins, wrapped assets, and memecoins spread across multiple wallets.
Blockchain security firm PeckShield estimated total losses could reach $285M. The exploit did not stem from a smart contract flaw. PeckShield founder Jiang Xuxian said the attacker gained access through compromised administrative private keys.
DRIFT (DRIFT) was trading at $0.03998 at the time of writing, down 42.18% in 24 hours from a pre-selloff level near $0.069. Trading volume surged 354.49% to $37.97M, while market capitalization fell to $23.23M.
Also Read: Bitget Launches Dedicated AI Trading Account For Its GetClaw Agent
ZachXBT Circle Criticism
ZachXBT said millions in USDC were transferred between Solana and Ethereum via the Cross-Chain Transfer Protocol within hours, with no intervention from Circle. He noted the transfers occurred during U.S. business hours.
His complaints followed earlier reports that Circle had frozen over 16 business hot wallets that remained locked. ZachXBT called the measures imbalanced and questioned their effectiveness. He had also previously flagged bad actors exploiting U.S.-Iran war panic to promote crypto scams.
Drift Hack Method and DeFi Contagion
The attack was not opportunistic. According to security researchers, the exploiter created a fraudulent token called CarbonVote Token ($CVT) on Solana roughly three weeks before the breach. By injecting about $500 in liquidity and wash-trading the token, the attacker built a fabricated oracle price history.
On the day of the attack, the exploiter bypassed platform safeguards through compromised administrator keys and listed the worthless token on Drift's spot market.
The attacker then drained multiple pools, changed admin keys to lock out the protocol team, and bridged stolen assets to Ethereum to purchase ETH.
Read Next: Bitcoin Goes Below $67K After Trump Vows To Bomb Iran To 'Stone Ages'