Drift Protocol, one of the pillars of the Solana ecosystem, lost approximately USD 280 million as a result of a carefully planned attack. This is one of the biggest exploits in the history of decentralized finance. This was not a coincidence, but what is even more surprising is Circle’s reaction, which was pointed out by the famous blockchain detective ZachXBT on the X portal.
Drift attacked – action straight from a Hollywood hacker movie
Drift described the attack as a “highly advanced operation” that was preceded by weeks of preparation. The perpetrator gained unauthorized access to the protocol through the so-called mechanism. durable noncesi.e. previously signed transactions that can be executed at any time in the future. Sounds like a minor technicality? Nothing could be further from the truth, because it was this loophole that became the key to the entire seizure of funds worth USD 280 million.
The stolen tokens include JLP, SOL, USDC, cbBTC, and wBTC. All deposits were affected – lending, treasury and trading. The protocol immediately froze all functions and updated multisig, removing the compromised wallet. Efforts are ongoing in cooperation with exchanges, bridges and law enforcement agencies.
Circle under fire – ZachXBT points out mistakes and lack of reaction
The case did not end with the exploit itself. Renowned blockchain detective ZachXBT publicly attacked Circle (the issuer of USDC), pointing out that over $230 million in USDC linked to the attack was transferred from Solana to Ethereum via Circle’s own CCTP protocol. And for six hours absolutely nothing was done.
The funds were transferred and to this point nothing has been done
– wrote ZachXBT.
This is a significant setback for Circle, especially since the company recently froze 16 USDC wallets linked to private entities, without any explanation. The cryptocurrency community immediately raised the alarm – how is it possible that centralized control over USDC acts selectively and at the speed of a sloth from Zootopia just when every minute counts? This question still remains without a satisfactory answer.
