Circle faces lawsuit as $230M of stolen USDC moved off-chain after Drift breach
A new class action lawsuit has put Circle under legal scrutiny over its response to the flow of stolen USDC following the Drift Protocol hack.
Summary
- Circle accused of failing to stop $230M in USDC transfers linked to Drift exploitation.
- The loss of the class claims could have been reduced if the Circle had intervened in time.
- Plaintiffs cite previous fund freezes to argue that the Circle has the power to act.
According to a filing in US district court in Massachusetts, Drift investor Joshua McCollum brought the lawsuit on behalf of more than 100 affected users, alleging that Circle failed to stop nearly $230 million in USDC transfers made after the April 1 exploit.
Court documents say the funds were transferred across chains using Circle’s Cross-Chain Transfer Protocol for several hours, giving the attackers enough time to redeploy assets without disruption. Attorneys representing McCollum said the outcome could have been different if immediate action had been taken.
“The Circle allowed this criminal use of its technology and services,” the legal team wrote, adding that “the loss would not have occurred, even if it had been greatly reduced, if the Circle had acted in time.”
Claims included in the lawsuit include negligence and aiding and abetting, with damages to be determined at trial. Lawyers from Mira Gibb, representing the plaintiffs, pointed to the latest move to challenge any suggestion that intervention was impossible.
About a week before the Drift breach, Circle suspended 16 funds linked to the USDC case tied to a closed civil lawsuit in the United States. Plaintiffs argue that the prior act demonstrates both technical ability and practical precedent for entry when funds are at stake.
The dispute dates back to a massive exploit targeting Solana-based Drift Protocol, in which attackers spent more than $285 million, including more than 50% of the total value of the locked platform at the time.
Data from DeFiLlama shows that the total amount locked up has since dropped to around $251 million, which is a significant drop from the $1.5 billion recorded in September 2025.
On-chain analysis showed an attacker quickly converting assets into stablecoins, including USDC, before mining a portion of Ethereum and switching to Ether. Investigators later traced parts of the proceeds to Tornado Cash, a privacy tool often used to hide transaction methods.
Elliptic linked the activity to suspected North Korean state-backed actors, noting that more than 100 activities passed through Circle’s infrastructure during US business hours.
Drift Protocol has confirmed the incident as it progresses, halting deposits and withdrawals while working with security companies and exchanges.
“Drift Protocol is facing a serious attack. Deposits and withdrawals are suspended,” the team said at the time, adding, “This is not an April Fool’s joke.”
Security researchers urged users to withdraw wallet authorization and avoid connecting to the platform until conditions stabilize.
Legal and judicial limitations are invoked under scrutiny
The debate has turned to how much responsibility stablecoin issuers bear when they retain control of token contracts.
The circle has the power to freeze goods at the contract level, although doing so without a formal letter can expose firms to regulatory and reputational risks. Industry voices framed the decision as a balance between preventing immediate harm and complying with consistent legal standards.
Lorenzo Valente, director of digital asset research at ARK Invest, pointed out the difficulty of setting a clear rule.
“Every future period is now a judgment call. Every non-stop is a political statement. Why should the Drift criminal be stopped but not that Nigerian money laundering fund? Why this protester but not that one?”
He added that opinions may differ depending on how that trade-off is measured.
“Whether the circle gets it right depends on how much you weigh the principles of the law against the physical harm. Reasonable people disagree.”
Drift is moving to rebuild with USDT support
The steps taken after the exploit point to a move away from reliance on the Circle’s infrastructure.
Drift received nearly $150 million in funding to support recovery efforts, including $127.5 million from Tether. The capital will be used to compensate affected users and prepare for a relaunch focused on USDT as Solana’s primary payment asset.
Programs include a line of credit tied to future income, liquidity support for market makers, and ecosystem grants aimed at restoring activity. A recovery token is also in the works, allowing affected users to claim from a pool funded by trading fees and newly raised funds.
Paolo Ardoino, CEO of Tether, said the focus is on restoring stability while rebuilding trust.
“The focus is on restoring user confidence and supporting a strong recovery, with a structure that aligns recovery with real activity and long-term growth.”
The market’s response has already started to show, as DRIFT surged 20% to over $0.061, its highest level since the day of the exploit.
