The Drift hack looked like a typical smart contract exploit until the postmortem revealed something far more elaborate: a six-month DPRK intelligence operation involving in-person social engineering at crypto conferences, fully constructed professional identities, and a $1 million deposit to build trust. Then, after $232 million in USDC was stolen, Circle declined to freeze the funds while attackers bridged them across chains for six hours during business hours. Michael Lewellen from Turnkey and Amanda Wick from VerifyVASP tackle what the Drift compromise teaches about operational security in crypto, why Circle’s decision raises hard questions about stablecoin issuer responsibility, and whether the legal framework is forcing companies to choose between compliance and doing what’s right.
