Circle Internet Financial now confronts a class action lawsuit in the United States after investors alleged the company failed to act during a large-scale crypto exploit that drained hundreds of millions from Drift Protocol.
The complaint, filed in a U.S. district court in Massachusetts, comes from Drift investor Joshua McCollum on behalf of more than 100 affected users. It centers on Circle’s handling of roughly $230 million in USDC that moved across blockchains after the April 1 attack.
Circle is being sued for allegedly allowing North Korean hackers to move $230 million in stolen USDC after the Drift Protocol hack. https://t.co/IMLJS1drSZ pic.twitter.com/EjnYQAkX2m
— Jacob Robinson (@JacobRobinsonJD) April 16, 2026
Lawsuit claims Circle failed to intervene during critical window
Court filings state that attackers routed funds through Circle’s Cross-Chain Transfer Protocol over several hours. That time window allowed assets to shift from Solana to Ethereum without disruption, according to the plaintiffs.
“Circle permitted this criminal use of its technology and services,” attorneys representing McCollum wrote. They added that the “losses would not have occurred, or would have been substantially reduced, had Circle taken timely action.”
The legal claims include negligence and aiding and abetting conversion. Mira Gibb, the law firm representing the group, seeks damages that will be determined at trial.
Plaintiffs also point to a prior enforcement action. About a week before the Drift incident, Circle froze 16 USDC wallets tied to a sealed U.S. civil case. The filing argues that this earlier move demonstrates both the technical capacity and precedent to intervene.
Exploit traced across chains as laundering tools used
The dispute follows a major exploit targeting Drift Protocol on the Solana blockchain. The attack drained more than $280 million, which represented a significant portion of the platform’s total value locked at the time.
On-chain data shows that attackers converted assets into stablecoins, including USDC, before bridging funds to Ethereum. The assets then moved into Ether and passed through Tornado Cash, a privacy protocol used to obscure transaction trails.
Crypto analytics firm Elliptic linked the activity to suspected North Korean state-backed actors. The firm reported that more than 100 transactions flowed through Circle’s infrastructure during U.S. working hours.
Drift confirmed the breach as it unfolded.
“Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended,” the team said at the time, adding, “This is not an April Fool’s joke.”
Security researchers urged users to revoke wallet approvals and avoid interaction with the platform until conditions stabilized.
Legal gray area over stablecoin issuer responsibilities
The case highlights a long-standing tension in crypto markets. Stablecoin issuers like Circle retain control over token contracts and can freeze assets. At the same time, companies often state that such actions require legal authorization.
Circle has maintained a policy of acting only when directed by law enforcement or court orders. This approach reflects its positioning as a regulated financial entity operating under U.S. compliance frameworks.
That stance now faces scrutiny in court. Plaintiffs argue that Circle’s role in facilitating transfers creates a duty of care that extends beyond strict legal triggers.
The broader regulatory backdrop continues to shift. Proposed frameworks such as the GENIUS Act aim to impose bank-like compliance requirements on stablecoin issuers. This environment may influence how courts interpret responsibility during incidents involving illicit funds.
Industry debate splits over intervention vs rule of law
The lawsuit has sparked debate across the digital asset sector. Some argue that intervention without legal orders risks arbitrary decision-making and inconsistent enforcement.
Lorenzo Valente, director of research for digital assets at ARK Invest, addressed this dilemma.
“Every future freeze is now a judgment call. Every non-freeze is a political statement. Why freeze the Drift hacker but not that sketchy Nigerian fraud wallet? Why this protester but not that one?”
He added:
“Whether Circle got it right comes down to how much you weigh rule-of-law principles vs concrete harm. Reasonable people disagree.”
Others see the case as a test of accountability in a market where centralized control still exists beneath decentralized infrastructure.
Drift shifts strategy as recovery efforts begin
In the aftermath of the exploit, Drift has moved to rebuild. The protocol secured nearly $150 million in fresh funding, including $127.5 million from Tether, to support user compensation and relaunch efforts.
Today, Drift is announcing a collaboration with @tether and other partners totaling up to nearly $150 million to support our commitment to a relaunch with USDT at the center, and a path to user recovery.
— Drift (@DriftProtocol) April 16, 2026
These funds encompass a $100M revenue-linked credit facility, an ecosystem…
Plans include liquidity support, ecosystem grants, and a recovery token tied to future revenues. The protocol also signaled a shift toward USDT as its primary settlement asset on Solana.
Paolo Ardoino, CEO of Tether, said in the announcement.
“The focus is on restoring user confidence and supporting a strong relaunch, with a structure that aligns recovery with real activity and long-term growth.”
Market reaction followed. The DRIFT token rose 20% to above $0.061, marking its highest level since the day of the exploit.
A pivotal test for stablecoin governance
The outcome of the case may shape how stablecoin issuers respond to future incidents. A ruling against Circle could push companies toward faster intervention during hacks. A decision in Circle’s favor may reinforce a strict legal-first approach.
For now, the case places one of the largest stablecoin issuers at the center of a legal and operational test that extends beyond a single exploit.
Roman Zaika
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
