Circle Internet Financial Faces Class-Action Over $230M Drift Protocol USDC Hack Inaction

Circle Internet Financial is facing a class-action lawsuit tied to the April 1 Drift Protocol exploit, with plaintiffs arguing the stablecoin issuer failed to freeze stolen USDC as attackers moved funds across blockchains.

“Home / News / Crypto / News / Circle Hit With Lawsuit Over $230M USDC Drift Hack as Investors Claim Funds Could Have Been Frozen News Circle Hit With Lawsuit Over $230M USDC Drift Hack as Investors Claim Funds Could Have Been Frozen Published 17 April 2026”

CCN

Cointelegraph reports that the lawsuit was filed by Drift investor Joshua McCollum in a US district court in Massachusetts on Wednesday, alleging Circle allowed attackers to transfer about $230 million worth of USDC from Solana to Ethereum via Circle’s Cross-Chain Transfer Protocol (CCTP) over several hours without intervention.

CoinCentral

CoinCentral similarly says the hack hit Drift Protocol on April 1, draining an estimated $280 million, and that the lawsuit accuses Circle of negligence and aiding and abetting the unlawful conversion of the stolen funds.

Coinpaper frames the allegations as Circle allowing “around $230 million in USDC from Solana to Ethereum through Circle’s Cross-Chain Transfer Protocol (CCTP) over a period of several hours without freezing or blocking the transactions.”

Across outlets, the legal theory centers on Circle’s alleged ability to freeze or block at the bridge or contract level, and the claim that it did not act in time.

Cointelegraph also quotes the plaintiffs’ attorneys writing, “Circle permitted this criminal use of its technology and services,” and adding, “These losses would not have occurred, or would have been substantially reduced, had Circle taken timely action.”

The Block adds that the lawsuit accused Circle Internet Financial of failing to act swiftly to freeze the stolen USDC tied to the attack, stating, “Circle allegedly took no action to freeze the funds, despite having the technical and contractual authority to do so,” while describing the Drift exploit as occurring after an attacker gained unauthorized access to the platform and removed withdrawal limits.

The lawsuit’s factual narrative, as described by multiple outlets, emphasizes a multi-hour window after the April 1 exploit during which attackers allegedly moved USDC using Circle infrastructure.

Cointelegraph says the complaint accused Circle of allowing attackers to transfer about $230 million worth of USDC from Solana to Ethereum via CCTP “over several hours without intervention,” and it adds that the suit accuses Circle of aiding and abetting conversion as well as negligence.

Coinpaper

FinanceFeeds describes the same core timeline as a roughly $230 million movement through USDC and Circle’s Cross-Chain Transfer Protocol over an eight-hour window, and it says plaintiffs allege Circle remained passive despite possessing both contractual authority and technical capability to blacklist addresses and freeze stolen USDC.

Crypto.news similarly states that “the funds were routed across chains using Circle’s Cross-Chain Transfer Protocol over several hours,” giving attackers time “to reposition assets without disruption.”

CoinCentral and Coinpaper both tie the alleged inaction to the use of Circle’s CCTP bridge to move stolen USDC from Solana to Ethereum, with CoinCentral stating that “The attackers usedCircle’sown Cross-Chain Transfer Protocol to bridge the stolen USDC from Solana to Ethereum.”

Plaintiffs also point to Circle’s prior conduct as evidence that it could intervene, with Cointelegraph reporting that McCollum’s lawyers pointed out that Circle froze 16 USDC wallets about a week before the Drift incident in connection with a sealed US civil case.

The Block adds that Circle CEO Jeremy Allaire defended the company’s approach by saying Circle only freezes USDC wallets “at the direction of law enforcement or the courts,” and he warned that stepping outside established legal processes could become a “significant moral quandary.”

Several outlets tie the Drift exploit to suspected North Korean state-backed activity and describe how proceeds were routed through privacy tools.

“The lawsuit alleges attackers transferred around $230 million in USDC from Solana to Ethereum through Circle’s Cross-Chain Transfer Protocol without intervention”

Coinpaper

Cointelegraph says crypto analytics firm Elliptic suspected the exploit was committed by North Korean state-backed hackers, who made over 100 transactions via Circle’s bridging technology during US working hours, where the stablecoin company is based.

Coinpaper similarly reports that Elliptic suggested North Korean state-backed hackers may have been responsible, and it states that the attackers reportedly used Circle’s bridging technology in more than 100 transactions during normal US business hours.

Cointelegraph further says the funds were converted into Ether (ETH) and sent through the Tornado Cash privacy protocol to launder the proceeds and obscure the trail.

CoinCentral and Coinpaper both describe the conversion into Ether and the use of Tornado Cash after the bridge transfer, with CoinCentral stating that “the stolen USDC was converted into Ether and routed through Tornado Cash, the privacy protocol, to obscure the trail.”

Crypto.news also says investigators later tracked parts of the proceeds through Tornado Cash, describing it as a privacy tool often used to obscure transaction trails.

The Defiant goes further in its description by stating that the lawsuit alleges attackers—reportedly tied to North Korea's government—offloaded $230 million in stolen funds using Circle’s USDC stablecoin and CCTP bridge infrastructure over eight hours without freezing the assets.

Circle’s position, as presented by The Block and echoed through other coverage, centers on legal process and the limits of unilateral freezing.

The Block reports that in a press conference earlier this week, Circle CEO Jeremy Allaire defended the company’s decision by saying that the company only freezes USDC wallets “at the direction of law enforcement or the courts.”

Crypto Briefing

The Block also quotes Allaire warning that taking action outside established legal processes in private matters could become a “significant moral quandary,” and it adds that “If there are others that believe that Circle should just step away from what the law says and do its own, make its own decisions, I think it's a very risky proposition.”

Cointelegraph provides a separate defense framing through ARK Invest’s director of research for digital assets, Lorenzo Valente, who argued on Thursday that freezing funds without a legal order opens the door for arbitrary discretion.

Cointelegraph quotes Valente directly: “Every future freeze is now a judgment call. Every non-freeze is a political statement.”

Cointelegraph continues with Valente’s rhetorical questions, including “Why freeze the Drift hacker but not that sketchy Nigerian fraud wallet? Why this protester but not that one?” and it adds that Valente speculated the stolen funds will likely fund North Korea’s nuclear weapons program, saying, “Whether Circle got it right comes down to how much you weigh rule-of-law principles vs concrete harm. Reasonable people disagree.”

Across the reporting, the dispute is framed as a legal and ethical boundary between immediate harm prevention and rule-of-law constraints, with Circle and its defenders emphasizing the risk of selective or discretionary freezing.

The lawsuit arrives as Drift Protocol moves to rebuild after the April 1 exploit, and multiple outlets describe a recovery package and a pivot away from USDC settlement.

“Circle faces a class action lawsuit over the Drift Protocol hack, and Solana’s April 16 price market sits at The lawsuit, filed by Gibbs Mura, alleges Circle failed to freeze stolen funds linked to North Korean hackers”

Crypto Briefing

The Block says Drift secured a proposed recovery package of up to $127.5 million from Tether and $20 million from other partners, and it describes the structure as intended “to support user recovery following the April 1 exploit and facilitate Drift’s relaunch as the largest USDT-based perpetual DEX on Solana.”

crypto.news

Crypto.news adds that Drift has secured nearly $150 million in fresh funding to support recovery efforts, including $127.5 million from Tether, and it says the capital will be used for compensating affected users and preparing a relaunch centered on USDT as the primary settlement asset on Solana.

Invezz similarly states that Drift pivoting settlement to USDT on Solana includes issuing a recovery token backed by fees plus ~$150M capital, including $127.5M from Tether, and it reports that DRIFT rose 20% to above $0.061 after the news.

The Defiant’s description adds that the exploit caused total value locked to collapse from $550 million to under $250 million and triggered indirect losses across at least 20 additional DeFi protocols, while also claiming the lawsuit alleges Circle accumulated over $420 million in alleged compliance failures.

FinanceFeeds frames the case as a “hardened” test for the responsibility of stablecoin issuers in decentralized finance and says plaintiffs aim to force a structural change in how Circle manages its blacklist and intervention protocols in the future.

Across the coverage, the stakes are both legal—damages to be determined at trial—and operational, as Drift’s relaunch plan and the broader debate over cross-chain oversight and freeze authority continue to develop.