ZachXBT reports that the attacker moved funds through Circle’s protocol without intervention, as USDC was not frozen during a critical 35-minute holding period.
Blockchain investigator ZachXBT revealed that an address tied to the Coinbase hack converted 5 million DAI into 5 million USDC and held the funds for about 35 minutes before transferring them via a cross-chain bridge. The transfer included use of Circle’s Cross-Chain Transfer Protocol (CCTP), but Circle did not freeze the USDC during this timeframe. The broader hack involved over $300 million in stolen funds, facilitated by a bribed Coinbase customer service employee.