Circle Snoozes While Hackers Dance with $280M – ZachXBT Calls Out CEO Allaire

Once again, the self-proclaimed blockchain watchdog, ZachXBT, has taken aim at Circle and its CEO, Jeremy Allaire, for their apparent nap during the $280 million heist tied to Drift Protocol.

In his usual dramatic flair, ZachXBT blasted the company’s delay in responding while hackers gleefully moved funds across blockchains. A casual day in the crypto world, apparently.

Circle Under Fire

Posting on X, ZachXBT didn’t mince words, accusing the stablecoin giant of being “asleep” while millions in USDC were shifted from Solana to Ethereum. And not just a few transactions-around 100. He sarcastically noted that “value was moved and nothing was done.” It’s almost like Circle wasn’t even aware that $280 million was getting a free ride. In a different post, he referred to the recent freezing of 16 business wallets as “competence”-or rather, the lack of it. And, of course, he called Circle’s behavior “incompetent” and labeled the firm and Allaire as “bad actors for the industry.” Well, well, well.

The world of crypto was abuzz with the question: could a quicker response have stopped the endless stream of funds moving around during the hack? After all, the money seemed to flow without interruption for hours. Timing is everything, right?

Meanwhile, Drift Protocol came forward with its own take on the incident, claiming it wasn’t their fault, and certainly not the fault of their well-written smart contracts. Oh no, this was a “highly coordinated and sophisticated attack”-involving a “novel attack” (fancy word for clever trickery) that used durable nonces. This allowed the attacker to sign transactions ahead of time and execute them later-because who wouldn’t want to plan their heist like a seasoned professional?

The attacker breezed past real-time detection systems, gaining control over Drift’s Security Council permissions with ease. No code vulnerabilities here, folks-just a solid dose of social engineering. The result? The hacker got their hands on 2-of-5 multisig approvals, pulled off a swift admin transfer, and then added some malicious assets. Oh, and they removed withdrawal limits-just in case. The audacity!

Drift Hack Timeline

Drift’s own timeline shows the attack had been brewing for weeks. Starting on March 23, the attacker set up durable nonce accounts tied to legitimate multisig members and their own wallets. The preparations continued through March 27 and 30, with a multisig migration and more nonce activity. Finally, on April 1, the plan was set into motion, with pre-signed transactions executing just after a legitimate test transaction. Who said hackers don’t plan ahead?

In a bid to regain some credibility, Drift froze the remaining protocol functions, kicked the compromised wallet from the multisig, and started working with security firms, exchanges, and law enforcement to track down the stolen assets. At least someone’s doing something-just a few weeks too late.

2026-04-03 00:33

Circle Under Fire

Drift Hack Timeline

Read More