Circle: Legal limits stopped freezing $275M USDC after Drift hack

Circle, the issuer of the USDC stablecoin, reported it lacked the legal authority to freeze roughly $275 million that was drained from Drift, a decentralized derivatives platform, in a recent exploit.

The company said it reviewed the blockchain addresses involved and concluded there was no legal basis to blacklist or freeze the tokens tied to the incident. Circle noted its ability to intervene depends on contract-level controls and applicable law, and that not every on-chain movement falls within those controls.

Company officials told investigators and affected parties Circle does not have unilateral power to freeze every USDC balance on every blockchain or smart contract. When tokens are held in noncustodial smart contracts or in accounts outside U.S. jurisdiction, contractual and legal mechanisms for freezing can be limited.

Circle confirmed it has been sharing transaction records with law enforcement and will act on valid legal orders that permit restraint or recovery of funds. The firm described technical features of USDC that allow blacklisting in certain circumstances, which it has used to comply with sanctions and court orders.

Drift reported the exploit after an attacker drained funds from the protocol’s liquidity pools. Blockchain analytics teams and on-chain investigators are tracking the flow of the stolen USDC to identify addresses that could be linked to custodial exchanges or services where authorities or issuers might obtain legal orders to freeze funds.

Drift is working with external security advisers and exploring compensation options for affected users. Exchanges and on-chain monitoring teams are scanning for deposits of the stolen USDC that could be intercepted if linked to custodial platforms subject to court or regulatory orders.

Legal specialists note that jurisdictional fragmentation and the decentralized design of many DeFi protocols complicate recovery of stolen cryptocurrency. Even when a stablecoin issuer can technically blacklist an address, enforcing that action often requires coordination with regulators and courts, particularly if funds pass through entities outside the issuer’s legal reach.

Circle said it remains available to comply with enforceable legal directives and will continue providing information to authorities handling the investigation and any recovery efforts.