Ethereum

Drift

Solana

ZachXBT

USDC

<p>Blockchain investigator ZachXBT has once again slammed Circle and its CEO, Jeremy Allaire, following alleged inaction during the $280 million exploit tied to Drift Protocol.</p><p>He described the entire fiasco as a critical delay in response as funds were actively moved across chains.</p><h2 id="circle-under-fire">Circle Under Fire</h2><p>In a post on X, ZachXBT <a href="https://x.com/zachxbt/status/2039496650906034602" rel="noopener noreferrer nofollow">said</a> the stablecoin issuer “was asleep” as millions in USDC were bridged from Solana to Ethereum during the exploit. In a separate update, he found that the transfers occurred across roughly 100 transactions. He added that “value was moved and nothing was done.” He also cited a recent incident involving the freezing of over 16 business wallets, and <a href="https://cryptopotato.com/most-incompetent-freeze-zachxbt-slams-circle-as-wallet-ban-begins-to-unravel/" rel="noopener noreferrer nofollow">called</a> Circle’s handling “incompetent” while labeling the firm and Allaire as “bad actors for the industry.”</p><p>The allegations emerged as several market commentators <a href="https://x.com/DoctorDouc75823/status/2039500912255721528" rel="noopener noreferrer nofollow">debated</a> whether faster action could have limited the movement of funds during the exploit window, particularly as large volumes were reportedly <a href="https://x.com/arkham/status/2039585045061751173" rel="noopener noreferrer nofollow">transferred</a> over several hours without interruption.</p><p>Meanwhile, Drift Protocol disclosed that the incident stemmed from a highly coordinated and sophisticated attack rather than a flaw in its smart contracts. According to the team, a fraudulent actor gained unauthorized access through a “novel attack involving durable nonces,” which enabled pre-signed transactions to be executed later.</p><p>This allowed the attacker to effectively bypass real-time detection and quickly assume control over administrative permissions tied to the protocol’s Security Council. Drift confirmed that the exploit was not caused by compromised seed phrases or code vulnerabilities but instead involved unauthorized or misrepresented approvals, which were likely obtained through social engineering. The attacker secured the required 2-of-5 multisig approvals and executed a malicious admin transfer within minutes. They then introduced a malicious asset and removed withdrawal limits.</p><h2 id="drift-hack-timeline">Drift Hack Timeline</h2><p>The timeline shared by Drift <a href="https://x.com/DriftProtocol/status/2039564437795836039" rel="noopener noreferrer nofollow">revealed</a> that the groundwork for the attack began as early as March 23 with the creation of durable nonce accounts linked to both legitimate multisig members and attacker-controlled wallets. Additional preparations continued through a multisig migration on March 27 and further nonce activity on March 30, which led to the execution phase on April 1, when pre-signed transactions were triggered shortly after a legitimate test transaction.</p><p>In response, Drift froze remaining protocol functions, removed the compromised wallet from the multisig, and began coordinating with security firms, exchanges, and law enforcement to trace and potentially recover the stolen assets.</p><p>The post <a href="https://cryptopotato.com/zachxbt-accuses-circle-of-being-asleep-as-drift-hack-funds-moved-freely/" rel="noopener noreferrer nofollow">ZachXBT Accuses Circle of Being ‘Asleep’ as Drift Hack Funds Moved Freely</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.</p>

ZachXBT Accuses Circle of Being ‘Asleep’ as Drift Hack Funds Moved Freely

Table of Contents

CryptoPotato_News

Other articles published on Apr 2, 2026

Tokenized Stock Transfers Hit $2.87B in March

Bitcoin Easter sale loading?

European Diesel Prices Explode to $200 Per Barrel — Supply Crisis Deepens

Bitcoin ETFs Extend Inflows With $118 Million as Ether Adds $31 Million

DeFi is optimizing for gas, not for markets

Crypto Stabilizes as War Fears Ease with Crypto Bull Return, APEMARS Hits 1,539+ Backers; LINK an...

Join our free newsletter for daily crypto updates!