A new class action lawsuit has put Circle under legal scrutiny over its response to the movement of stolen USDC following the Drift Protocol hack.
Summary
- Circle accused of failing to halt $230M in USDC transfers tied to the Drift exploit.
- Class action suit claims losses could have been reduced if Circle had intervened in time.
- Plaintiffs cite earlier wallet freezes to argue Circle had the ability to act.
According to a filing in a U.S. district court in Massachusetts, Drift investor Joshua McCollum has brought the case on behalf of more than 100 affected users, alleging that Circle failed to stop roughly $230 million in USDC transfers carried out after the April 1 exploit.
Court documents state that the funds were routed across chains using Circle’s Cross-Chain Transfer Protocol over several hours, giving attackers enough time to reposition assets without disruption. Attorneys representing McCollum argued that the outcome could have been different had action been taken sooner.
“Circle permitted this criminal use of its technology and services,” the legal team wrote, adding that the “losses would not have occurred, or would have been substantially reduced, had Circle taken timely action.”
Claims filed in the suit include negligence and aiding and abetting conversion, with damages to be decided at trial. Lawyers from Mira Gibb, acting for the claimants, pointed to a recent enforcement move to challenge any suggestion that intervention was not feasible.
Roughly a week before the Drift breach, Circle froze 16 USDC-linked wallets tied to a sealed civil case in the United States. Claimants argue that the earlier action demonstrates both the technical capability and operational precedent to step in when funds are at risk.
The dispute traces back to a large-scale exploit targeting Solana-based Drift Protocol, where attackers drained more than $285 million, accounting for over 50% of the platform’s total value locked at the time.
Data from DeFiLlama shows that total value locked has since dropped to around $251 million, a sharp fall from its $1.5 billion peak recorded in September 2025.
On-chain analysis showed the attacker rapidly converting assets into stablecoins, including USDC, before bridging a portion to Ethereum and swapping into Ether. Investigators later tracked parts of the proceeds through Tornado Cash, a privacy tool often used to obscure transaction trails.
Elliptic linked the activity to suspected North Korean state-backed actors, noting that more than 100 transactions passed through Circle’s infrastructure during U.S. working hours.
Drift Protocol confirmed the incident as it unfolded, halting deposits and withdrawals while working with security firms and exchanges.
“Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended,” the team said at the time, adding, “This is not an April Fool’s joke.”
Security researchers urged users to revoke wallet approvals and avoid interacting with the platform until conditions stabilise.
Legal limits and judgment calls under scrutiny
Debate has since turned to how much responsibility stablecoin issuers carry when they retain control over token contracts.
Circle has the ability to freeze assets at the contract level, though acting without a legal order can expose firms to regulatory and reputational risks. Industry voices have framed the decision as a balance between immediate harm prevention and adherence to consistent legal standards.
Lorenzo Valente, director of digital asset research at ARK Invest, pointed to the difficulty of setting a clear rule.
“Every future freeze is now a judgment call. Every non-freeze is a political statement. Why freeze the Drift hacker but not that sketchy Nigerian fraud wallet? Why this protester but not that one?”
He added that opinions may differ depending on how those trade-offs are weighed.
“Whether Circle got it right comes down to how much you weigh rule-of-law principles vs concrete harm. Reasonable people disagree.”
Drift moves to rebuild with USDT backing
Steps taken after the exploit indicate a move away from reliance on Circle’s infrastructure.
Drift has secured nearly $150 million in fresh funding to support recovery efforts, including $127.5 million from Tether. The capital is set to be used for compensating affected users and preparing a relaunch centered on USDT as the primary settlement asset on Solana.
Plans include a credit line tied to future revenues, liquidity support for market makers, and ecosystem grants aimed at restoring activity. A recovery token is also in the works, allowing affected users to claim from a pool backed by trading fees and newly raised funds.
Paolo Ardoino, CEO of Tether, said the focus is on restoring stability while rebuilding trust.
“The focus is on restoring user confidence and supporting a strong relaunch, with a structure that aligns recovery with real activity and long-term growth.”
Market response has already begun to show, with DRIFT rising 20% to above $0.061, its highest level since the day of the exploit.
