Stablecoin Issuer Circle Faces Lawsuit Over Drift Protocol Hack

Circle Internet Group faces a class-action in a Massachusetts federal court over claims it failed to intervene as attackers siphoned funds during the Drift Protocol exploit. The lawsuit, filed by Drift investor Joshua McCollum on behalf of more than 100 claimants, contends Circle’s Cross-Chain Transfer Protocol (CCTP) allowed approximately $230 million worth of USDC to be moved from Solana to Ethereum over several hours on April 1 without timely action.

The plaintiffs allege that Circle’s inaction caused or substantially contributed to the losses and seek damages to be determined at trial. The case underscores ongoing questions about whether crypto firms that maintain control over user funds can or should intervene in real time to curb theft or misuse, and how that potential responsibility should be calibrated against regulatory constraints and legal authority.

Key takeaways

• The lawsuit alleges Circle had the technical capacity to freeze compromised funds, pointing to a prior action where Circle froze 16 USDC wallets in connection with a sealed civil case.
• The Drift attack leveraged Circle’s cross-chain facilities to move roughly $230 million in USDC from Solana to Ethereum over several hours, with the suit asserting Circle did not act to halt the transfers.
• Analysts at Elliptic have linked the exploit to DPRK-state–backed actors, noting the movement of funds through the network during U.S. business hours and subsequent attempts to obfuscate the trail via privacy tools.
• Circumstances surrounding the incident have reignited debate about the liability of DeFi and infrastructure providers when user funds are stolen, including arguments that freezing assets without a court order may create perverse incentives or political considerations for future action.
• Circle did not immediately respond to requests for comment, while industry observers and investors weigh the legal and policy implications for future risk management and user protection.

What the suit alleges and why it matters

The court filing, lodged in a Massachusetts district court, asserts that Circle “permitted this criminal use of its technology and services” and that timely intervention could have substantially reduced, if not prevented, the losses. The action frames Circle as potentially aiding and abetting conversion and as negligent in supervising the use of its own cross-chain tooling. The allegations hinge on the argument that Circle had, or should have had, the ability to freeze funds or intervene in the flows that enabled the theft, even if regulators and legal authorities did not immediately grant a freezing order.

As part of the filing, McCollum’s legal team notes that Circle froze 16 USDC wallets in connection with a separate sealed civil matter about a week before the Drift incident—an occurrence they say demonstrates Circle’s capacity to intervene in real time when needed. The docket referenced in the court filing is publicly accessible, and the plaintiffs point to that prior action as evidence of proportional capacity to halt similar transfers.

The broader question the case raises is whether firms that sit at the center of crypto rails bear a responsibility to act when wrongdoing is detected or suspected. In many cases, executives acknowledge practical constraints, including the lack of explicit legal authorization during fast-moving exploits. The Massachusetts suit seeks to compel accountability and damages, but it also spotlights a broader, unresolved tension between rule-of-law principles and the operational realities of decentralized finance ecosystems.

The Drift exploit, the mechanics, and the alleged response gap

The Drift Protocol incident involved a sequence of transfers that moved a large tranche of USDC across networks via Circle’s CCTP. The complaint alleges that attackers succeeded in moving about $230 million worth of USDC from Solana to Ethereum without timely intervention from Circle, enabling proceeds to be wired into a different chain against the users’ interests.

According to the plaintiffs, Circle’s tools were capable of halting or reversing suspicious activity, and the failure to intervene allowed the attackers to drain liquidity from one ecosystem into another. The suit frames Circle’s inaction as a failure to protect user funds, arguing that the consequences extended beyond the individuals directly affected to the broader ecosystem—potentially dampening confidence in cross-chain tooling and in platforms that retain de facto control over user tokens during such crises.

Commentary from the plaintiffs’ counsel emphasizes that the losses might have been less severe had Circle exercised timely control, raising questions about the threshold of permissible intervention for centralized crypto services in edge cases of theft or misappropriation. Circle’s response to the suit has not yet materialized in public commentary, and the company did not immediately respond to Cointelegraph’s request for comment.

Tracing the funds: laundering routes and attribution

Elliptic researchers have flagged the Drift exploitation as being consistent with DPRK-linked activity. In a post-creach analysis, the firm noted that more than a hundred transactions related to the assault occurred during U.S. working hours, a detail seen as relevant to attribution efforts and to understanding the operational tempo of the attackers. Elliptic’s assessment also describes how the proceeds were converted into Ether (ETH) and routed through privacy-oriented channels, including the Tornado Cash protocol, in an attempt to obfuscate the trail.

While attribution in crypto forensics remains complex and often contested, the Elliptic findings contribute to a broader narrative about the transnational and cross-chain nature of such exploits. The Drift incident has become part of a larger discourse on how sanctions-enforcement and tracing capabilities intersect with the practical realities of on-chain finance, and how firms that provide bridging and custody solutions fit into that equation.

“Whether Circle got it right comes down to how much you weigh rule-of-law principles vs concrete harm. Reasonable people disagree.”

Industry observers note that the Drift case sits at a crossroad: it tests the boundaries of what action is considered appropriate when funds are believed to have been stolen, and what legal authorities would be required to justify a freeze or rollback in a permissionless network context. The case also intersects with ongoing debates about the liability for DeFi developers and infrastructure providers when episodes of misuse occur on the rails they maintain.

Liability, intervention, and the investment view

In the wake of the lawsuit, the debate over liability intensified among investors and researchers. Lorenzo Valente, the director of research for digital assets at ARK Invest, argued that Circle’s decision to abstain from freezing funds in the absence of a legal order represents a defensible stance in strict adherence to rule-of-law principles. He contended that freezing assets without a court directive could invite arbitrary discretion and undermine established legal standards, framing the case as part of a bigger constitutional risk debate for crypto rails that operate across borders and jurisdictions.

Valente’s position reflects a broader sentiment in some investor and academic circles: that the legal architecture surrounding crypto infrastructure is still catching up to the pace and sophistication of on-chain activity. The case also underscores a key strategic tradeoff for users and builders: the tension between technical capability to intervene and the legitimate need for careful, legally grounded action that does not set dangerous precedents for arbitrary asset freezes.

As the legal process unfolds, observers will watch for how the court interprets the responsibilities of crypto infrastructure providers and whether any settlement or court ruling could redefine the standard for future incidents. The Drift lawsuit is not the only lens on this issue, but it is among the most high-profile, given the scale of funds involved and Circle’s central role in bridging assets across chains.

What readers should watch next

The case is still early in its trajectory, and the court has yet to determine the appropriate remedies or establish a clear framework for liability in similar contexts. Key questions to watch include whether a court will require or authorize asset freezes in future incidents, how damages will be calculated, and what this could mean for cross-chain infrastructure providers and custody services.

Regulators and lawmakers, too, will likely scrutinize the evolving balance between proactive risk management and the prescriptive limits of authority over private-led, permissionless networks. For investors and users, the underlying takeaway is that accountability mechanisms for crypto rails are still taking shape—and how those mechanisms emerge could influence risk models, product design, and regulatory engagement in coming quarters.

As Circle and the Drift investors navigate these questions, market participants will be watching for any legal milestones, potential settlements, or policy clarifications that could tilt how similar incidents are managed in the future. The evolution of this case could help define whether asset freezes become a common tool in crisis management or remain extraordinary measures bound by formal due process.