There's an under-discussed reason why businesses will launch their own stablecoin: the ability to control freezing assets.
The Drift attack shows why.
On April 1st, a North Korean-affiliated group exploited Drift Protocol for roughly $270M. Shortly after, the attacker swapped stolen assets into USDC. For about 6 hours, during US business hours, the funds sat in USDC, even moving through Circle's CCTP bridge from Solana to Ethereum. While the money was in USDC, it could have been frozen. None of it was.
Hacks like this have sadly become common for DeFi protocols and crypto companies. For fintechs, banks, and other companies now building with stablecoins, this is totally unacceptable.
Purists will say that utilizing freezing is against the ethos of crypto permissionlessness and censorship resistance. I don’t agree. This is not the role for fiat-backed payment stablecoins. For most companies, security has to be the priority, and freezing is a useful tool in the tool belt.
Freezing is a feature
The ability to freeze stablecoins is a feature. It's an important break-glass security mechanism. It’s also required functionality for issuers under GENIUS to be able to comply with law enforcement requests.
But the ability to use freezing as an effective security last resort depends on who issues the stablecoin. If a business is building on somebody else's stablecoin, they are at the whim of that stablecoin issuer’s procedures, preferences, and incentives. Drift presumably attempted to get the USDC frozen over those ~6 critical hours...unsuccessfully. Consumers have a far worse chance of recovering their funds as a result.
If a business launches its own stablecoin, it controls the big red button. They can hit it immediately when a hack or true emergency occurs. Or, if that business is working with an issuance platform that launches a sponsored stablecoin on their behalf, the two can have a direct bat line and pre-agreed procedures for how/when to freeze funds in an emergency.
This could happen to any company
It’s worth noting, the Drift hack was incredibly sophisticated. The attackers spent 6 months building relationships with the team, posing as a quant trading firm, meeting contributors face-to-face multiple times, then delivering malware through what looked like routine collaboration.
This does not appear to be a case of careless security. This was not a risk isolated to "crypto" companies. This was likely a state actor executing a remarkably sophisticated and patient operation built primarily on social engineering, not a code vulnerability.
This type of incident could happen to careful, non-crypto native companies. Companies building with stablecoins need to take all available precautions against this type of attack. This includes freezing funds in an emergency.
Freezing as a deterrent
Potentially more important: just the threat of freezing is a deterrent.
Digital assets are an attractive honeypot because of the lack of reversibility. If a would-be hacker knows the stolen stablecoins can and will be instantly frozen, that honeypot is a lot less sweet.
A 6-month intelligence operation and putting up $1M in capital starts to make less economic sense when there's a strong chance the funds get frozen before they can be moved into unfreezeable assets.
The ability for a company to freeze its stablecoin quickly may prevent it from being targeted in the first place.
Security over permissionlessness
The crypto purists will say freezing is antithetical to crypto because it's not very permissionless. I'd argue the opposite. The stablecoin ecosystem, and crypto ecosystem generally, is healthier with more issuers that have clearly defined freeze policies than with a few dominant issuers making discretionary calls behind closed doors.
If you want a censorship-resistant, permissionless asset, use Bitcoin, Ether, or DAI/USDS. Most fiat-backed stablecoins should optimize for security over permissionlessness. They still have the speed, cost, and programmability benefits that make stablecoins valuable. The policies around freezing just need to be transparent.
For companies building scaled stablecoin products, the Drift hack provides a valuable lesson: you want to own the freeze capability, or at minimum have a direct line to the entity that does.
Anything less is an unacceptable security dependency.
