Circle CEO Blames ‘Moral Quandary’ for Not Acting on $280M Drift Exploit

Allaire defended Circle’s inaction during the exploit, stating that Circle only acts when the law obligates it to do so.

The stablecoin issuer Circle has doubled down on its defense against criticism for failing to act during an exploit that led to roughly $280 million in losses from the Solana-based Drift Protocol.

This time, the company’s CEO, Jeremy Allaire, responded during a press conference in Seoul, South Korea, and cited a moral quandary. The chief executive insisted that Circle cannot decide which path is right or wrong and can only follow the rule of law when freezing wallets holding crypto assets. Because of the moral quandary, Circle could not quickly freeze the assets stolen from Drift Protocol.

The $280M Drift Exploit

It is no longer news that Drift Protocol lost millions of dollars earlier this month, as the exploit shook the industry. In a post-mortem analysis, the Drift team revealed that the incident was caused by a coordinated attack, not a smart contract flaw.

The attacker had gained unauthorized access to administrative permissions tied to the protocol’s security council through social engineering initiated about seven days before the incident. After securing 2 of 5 multisig approvals, introducing a malicious asset, and removing withdrawal limits, the exploiter was able to enable pre-signed transactions days later.

Market experts have linked the attack to the notorious North Korean hacking group Lazarus. While investigations are still ongoing, on-chain sleuths like ZachXBT believe the damage from the attack could have been reduced if Circle had frozen the stolen funds during the exploit window.

The attackers moved $230 million in USD Coin (USDC) from Solana to Ethereum via Circle’s Cross-Chain Transfer Protocol (CCTP). The transfer occurred across roughly 100 transactions. According to ZachXBT, Circle had the power to freeze the USDC, but chose to stay “asleep” instead, while the funds were moved over several hours without interruption.

A Moral Quandary For Circle

In defending Circle’s inaction during the exploit, Allaire said Circle only undertakes such actions in obligation under the law. He added that it would be a risky proposition to expect the stablecoin issuer to step away from what the law says to make its own decisions. While the company is working with regulators to provide clarity on taking preventive actions under extreme circumstances, the CEO insisted that Circle does not get to make such decisions.