Circle’s USDC Response Faces Scrutiny After the Drift Exploit as Tommy Shaughnessy and ZachXBT Claims Remain Partially Verified

By Diego Martinez

Drift Protocol’s exploit quickly turned Circle and USDC into part of the story, as questions about cross-chain stablecoin movement and issuer controls surfaced alongside the breach itself.

What is directly confirmed is that Drift said on April 1, 2026 it was under active attack, had suspended deposits and withdrawals, and was coordinating with security firms, bridges, and exchanges while containment efforts were underway.

Outside reporting then expanded the scale of the incident: more than $250 million was reported transferred to the attacker’s address based on Arkham data cited by Decrypt, while the same report said estimates ran as high as $285 million.

Why Circle’s USDC Response Drew Scrutiny During the Drift Exploit

The strongest verified basis for the backlash is structural rather than rhetorical: Circle’s CCTP documentation for Ethereum and Solana shows that native USDC can move across the same networks at the center of the incident, which is why the issuer’s response became part of the security debate.

A single secondary report said ZachXBT accused Circle of acting too slowly as USDC moved from Solana to Ethereum, but the original post was not directly recovered, so that criticism remains second-hand rather than primary-source confirmed.

A separate unconfirmed Telegram-sourced claim attributed similar criticism to Tommy Shaughnessy, yet no directly fetched public post or interview was available to verify that attribution at filing time.

Circle’s own published controls are clearer than the social reaction. In its USDC terms, the company says it may block certain addresses and freeze associated USDC tied to blocked addresses, but no directly fetched Circle statement explained whether those tools were considered, attempted, or impractical during the Drift exploit.

Decrypt also reported that researchers suspected an exposed or compromised admin key, and quoted PeckShield founder Jiang Xuxian saying the admin keys were “definitely leaked or compromised”. That reported root-cause data matters because a key compromise can sharply narrow any practical intervention window before centralized controls are useful.

Scale sharpened the scrutiny. Drift’s DefiLlama profile showed roughly $244.95 million in TVL when fetched on April 2, 2026, underscoring that the exploit hit a venue large enough for every response delay to be examined closely.

Readers following the exploit’s wallet trail have already seen that this story grew beyond one alert, including AICryptoCore’s earlier coverage of a Drift-related address flagged for unusual activity, but the verified question here is narrower: how much control Circle realistically had once USDC routing became part of the exploit path.

What the Backlash Means for Stablecoin Trust and Security Expectations

The episode highlights a recurring crypto tension. Users often treat a centrally issued stablecoin as neutral market plumbing, yet Circle’s published freeze authority and CCTP support for Solana and Ethereum mean traders still expect an identifiable operator to act during fast-moving crises.

Those expectations are elevated because USDC is systemically large. On April 2, 2026, USDC was trading near $0.999671 with a roughly $77.18 billion market cap and about $14.71 billion in 24-hour volume, which is why questions about issuer responsiveness quickly extend beyond one exploited protocol.

For market readers separating security risk from broader positioning, that is a different problem from demand-side narratives like Bitcoin’s apparent-demand slowdown at the end of March or treasury-management stories like Riot Platforms’ sale of 500 BTC: the Drift episode is about whether stablecoin infrastructure can intervene fast enough once an exploit is already in motion.

Until a primary-source ZachXBT post surfaces, a public Tommy Shaughnessy statement is verified, or Circle issues a case-specific response, the defensible takeaway remains narrower than the original social-media framing: Drift confirmed the attack, reporting placed losses deep into the nine figures, and Circle’s published powers are now being judged against a live stress test.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.