Written by: Glendon, Techub News
On April 1, the decentralized exchange Drift Protocol on the Solana chain suffered a severe security attack, leading to the theft of approximately $295 million in assets, making it the largest DeFi security incident of the year. Before the incident, the total value locked in the protocol was about $535 million, but it rapidly dropped to $250 million after the attack, and its systemic operations nearly came to a complete halt.
Two weeks later, Drift Protocol officially announced an asset recovery plan yesterday and is preparing for protocol reconstruction. This plan is jointly promoted by Tether and several strategic partners, aiming to provide a total funding support of $147.5 million, including a maximum contribution of $127.5 million from Tether and a total of $20 million from other partners.
This support plan includes a $100 million revenue-linked credit facility, special ecosystem grants, and liquidity loans for market makers, with all funds initially concentrated into a dedicated user recovery fund, prioritized to compensate users affected by the attack. As the platform's trading revenue gradually rebounds, this mechanism aims to achieve sustainable repayments through dynamic fund injections, targeting systematic coverage of all $295 million in unrecovered losses over the coming months, thereby rebuilding market confidence and the long-term stability of the protocol without relying on token issuance or on-chain debt dilution.
Drift's specific measures involve a comprehensive redesign of the protocol with security as the core focus. Under the new framework, all multi-signature signers will be required to operate using dedicated signing devices, and transaction content must be independently verified outside the main signing interface prior to confirming signature operations. All critical management operations will be set with a time lock mechanism and equipped with real-time alert functions to mark and block any anomalies before proposal executions.
In addition, Drift will issue dedicated recovery tokens (different from the DRIFT governance token) to each user affected by the vulnerability incident. Each token represents a claim to the recovery fund and is transferable. Following this recovery plan, DRIFT rose to a high of $0.055 last night, with a short-term increase of over 22%.
The most noteworthy aspect of this announcement is the restart plan emphasized by Drift, which is centered around USDT. Due to Tether's generous funding, Drift will convert from USDC to USDT as its settlement layer upon relaunch. Furthermore, Tether will extend its market-making support mechanism for USDT through designated market makers to ensure that Drift has a deep and liquid market from the start.
However, contrasting sharply with the strong support from Tether, Circle finds itself mired in a whirlpool of public opinion due to its perceived "slow response" and "inaction" regarding the Drift attack incident. What is going on here?
Before delving into that, let's quickly outline the background and aftermath of the Drift attack incident.
Drift Protocol is a decentralized derivatives trading platform launched on the Solana chain in 2021, with core functions including perpetual contracts, spot trading, lending, and liquidity provision, and was once one of the perpetual contract exchanges with the highest TVL in the Solana ecosystem.
On April 1, Drift was hacked, and within less than an hour, more than $285 million in assets were drained from the protocol's treasury. However, this incident was not a traditional smart contract vulnerability or mnemonic phrase leak, but a sophisticated social engineering attack meticulously planned over time, exploiting flaws in the underlying blockchain mechanisms and governance structures. More accurately, it was a significant operational security failure of the Drift protocol.
The essence of the incident is that the attacker did not "breach" the system but made the system "voluntarily" relinquish control. The attacker exploited Solana's durable nonces mechanism, originally designed to support offline signing and hardware wallets, allowing transactions to be pre-signed and remain valid over long periods. However, due to a lack of effective usage constraints, this provided an opportunity for the attacker. After weeks of infiltration, the attacker disguised as a quantitative trader and a security committee member to establish trust, thereby inducing them to sign a series of seemingly routine governance operations. In reality, these commands invoked destructive operations, such as transferring admin privileges, adding forged asset CVT as collateral, and removing withdrawal restrictions.
On April 2, Drift officials detailed the attacker's general operating procedures: the attacker preemptively gained access through the durable nonce accounts and then successfully acquired enough approval rights during the multi-signature approval process (meeting the 2/5 multi-signature approval standard); subsequently, within just a few minutes, the attacker swiftly executed malicious admin privilege transfers, gaining protocol-level control; finally, they utilized that privilege to introduce malicious assets and completely removed all existing withdrawal restrictions, executing the attack on the existing funds.
The incident quickly triggered a chain reaction within the Solana ecosystem, affecting multiple DeFi protocols and causing extremely severe impacts and destruction throughout the crypto industry. According to SolanaFloor statistics, as of April 3, over 20 protocols, including Reflect Money, Ranger Finance, Neutral Trade, Elemental DeFi, Project 0, Lulo Finance, Asgard Finance, DeFi Carrot, Pyra, xPlace, and Fuse Wallet, have been seriously impacted, with estimated losses such as over $10 million for Prime Numbers Fi, around $6.4 million for Gauntlet, approximately $3.67 million for Neutral Trade, and about $2.9 million for Elemental DeFi.
While Drift and many DeFi protocols were suffering damages from the attack event, USDC issuer Circle unexpectedly found itself trapped in a whirlpool of public opinion concerning its "slow response" and "inaction."
In response to the attack incident, on-chain detective ZachXBT, and Delphi Digital co-founder Tommy Shaughnessy, among others, criticized Circle on Twitter for not freezing USDC transfers involved in the Drift attack.
Tommy Shaughnessy expressed that Circle, known for its centralized nature of USDC, chose to allow funds to flow freely. ZachXBT’s criticism was even harsher. He pointed out that Circle displayed sluggishness during the Drift attack, as the attacker transferred over 232 million USDC within 6 hours through the cross-chain transfer protocol CCTP, while Circle failed to take any freezing measures, allowing these funds to be successfully moved.
ZachXBT added that the Drift attack incident is not an isolated case. In fact, since 2022, Circle has repeatedly shown compliance failure when handling illicit funds, involving at least 15 major cases with a total amount exceeding $420 million. Despite Circle’s claims of having a robust compliance plan and retaining the right to freeze funds, it often only takes "minimal" actions when facing illegal funds.
Furthermore, ZachXBT listed several specific instances of Circle's "slow response," including the incident in May 2025, when Cetus Protocol was hacked for $223 million, and the attacker transferred 61 million USDC, yet Circle only provided a blacklisted address a month later.
In response to the criticism and scrutiny, Circle’s Chief Strategy Officer Dante Disparte stated that Circle only freezes USDC under legal compulsion and cannot make unilateral decisions. He also attributed the issue of Circle's slow response to the legal framework's lag behind technological development. Circle's CEO Jeremy Allaire stated that the company would not freeze USDC addresses involving hackers and vulnerability events without receiving law enforcement or court orders, claiming that intervening in user assets privately constitutes a "significant ethical dilemma."
Undoubtedly, such responses do not quell the outrage in public opinion but instead trigger further strong criticism from ZachXBT. ZachXBT pointedly rebutted that Circle's assertion of "acting according to the law" is fabricated by itself and contradicts its terms of service. In reality, no regulations explicitly state that issuers cannot actively freeze funds. Moreover, ZachXBT also provided screenshots to illustrate that Circle’s terms explicitly reserve the right to freeze funds, vehemently criticizing Circle's behavior as unforgivable, severely damaging investor interests and market trust.
Just when everyone thought that this controversy would remain at the level of mere verbal disputes, a representative of Drift investors, consisting of over 100 members, filed a class-action lawsuit against Circle in the District Court of Massachusetts, elevating this storm to a legal level. The plaintiffs claim that the Drift attack incident resulted in approximately 230 million USDC being transferred from Solana to Ethereum through Circle’s CCTP cross-chain within hours, but Circle failed to implement any freezing intervention. Based on this, the plaintiffs argue that Circle is suspected of assisting and abetting illegal fund conversion, while also exhibiting severe negligence.
Interestingly, just as Circle is embroiled in controversy, Drift has received significant funding support from Tether. This move by Tether seems to constitute a precise reputation strike, regardless of whether the motivation is a proactive assault to seize market share or a reactive response to Drift; the outcome is irreversible: Drift Protocol has officially announced a complete abandonment of USDC in favor of USDT as its core settlement asset. On one hand, this decision not only injects the liquidity needed for Drift’s survival but also achieves a revaluation of its worth on the psychological level in the market. After all, most protocols would quietly vanish after encountering similar events, but Tether's involvement undoubtedly opens up a genuinely feasible recovery path for Drift.
On the other hand, looking back at past incidents like those involving Ledger and Remitano, Tether quickly froze stolen USDT funds. Tether's rapid response again contrasts USDC as a "compliant yet powerless" stablecoin, while shaping USDT as "active and reliable" financial infrastructure.
Notably, DeFiLiama data shows that as of the time of writing, USDC remains the dominant stablecoin in the Solana ecosystem, with a market share close to 52%. The market cap of USDC on Solana exceeds $8.1 billion, while USDT is only about $3 billion. In this market view, the disparity in market capitalization between the two is significant.
However, Tether’s investment in Drift may very well become a critical blow to Tether's impact on the Solana stablecoin market.
While USDC is criticized in the industry as a "passive gatekeeper" due to its so-called "acting according to the law," and is even facing legal action, Tether is demonstrating through action that the value of a stablecoin lies not only in its pegging to the dollar and compliance qualifications, but also in whether it can become "the last actor" in systemic risk.
Drift's shift to USDT might become a historic turning point. Although at present, this event has not yet developed to a degree sufficient to prompt mainstream protocols in the Solana ecosystem to follow suit, its impact should not be underestimated, and market sentiment will change due to this matter.
Tether's $127.5 million investment, on some level, has transcended the realm of capital assistance and represents a reprogramming of trust. In the DeFi and cryptocurrency industries, when systemic risks break out, users do not just ask "are you compliant," but also "are you willing to stand up for me?" Tether has evidently captured this deep-seated demand from users, using the "ruins" of Drift to construct a new narrative of trust for USDT. Meanwhile, the compliance halo of USDC is gradually dissipating due to its inaction at a critical moment.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
