Key Points
- A proposed class action has been filed against Circle Internet Group in Massachusetts federal court.
- The lawsuit claims Circle neglected to freeze approximately $230M in USDC that was moved following the Drift Protocol breach on April 1.
- The exploit resulted in roughly $280M being stolen from Drift Protocol, marking it as one of 2026’s most significant DeFi attacks.
- Hackers leveraged Circle’s Cross-Chain Transfer Protocol to shift assets from Solana to Ethereum across multiple hours.
- Evidence points to North Korean state-sponsored actors as the likely perpetrators, according to blockchain analytics firm Elliptic.
Circle Internet Group now finds itself facing serious legal challenges. A class action complaint lodged this Wednesday in Massachusetts federal court alleges that the stablecoin giant failed to intervene while cybercriminals transferred approximately $230 million in USDC in the aftermath of a major cryptocurrency theft.
The breach targeted Drift Protocol on April 1, siphoning off around $280 million from the decentralized finance ecosystem. The lawsuit contends that Circle had an extended period — spanning several hours — to observe and potentially halt the movement of these illicit funds across multiple blockchain networks.
Joshua McCollum, a Drift Protocol investor serving as lead plaintiff, initiated the legal action representing over 100 affected members. The filing accuses Circle of both negligent conduct and actively assisting in the unauthorized transfer of stolen digital assets.
The perpetrators exploited Circle’s proprietary Cross-Chain Transfer Protocol to move the pilfered USDC tokens from the Solana network to Ethereum. Legal documents assert that Circle possessed both the technological means and contractual rights to freeze the associated wallets — yet failed to exercise either.
“Circle enabled this criminal exploitation of its infrastructure and products,” stated McCollum’s legal team. “These financial losses could have been prevented entirely, or significantly minimized, if Circle had responded with appropriate urgency.”
The legal representation comes from Mira Gibb law firm, with final damages to be calculated during proceedings.
The complaint references a notable comparison: approximately one week prior to the Drift attack, Circle froze 16 USDC wallets related to a confidential US civil matter. This precedent, plaintiffs maintain, demonstrates Circle’s capability and willingness to intervene — raising questions about the inconsistent response.
Circle’s Silence and ARK’s Counterargument
Circle has remained silent regarding the litigation. Requests for comment from Cointelegraph went unanswered at press time.
ARK Invest’s digital assets research director, Lorenzo Valente, offered a contrasting perspective defending Circle’s stance. He contended that implementing freezes absent court authorization establishes a problematic precedent — effectively granting private corporations unchecked authority over asset control.
“Every subsequent freeze becomes discretionary. Every decision not to freeze carries political implications,” Valente explained. He conceded, however, that the stolen assets would probably finance North Korea’s military ambitions.
“Determining whether Circle acted appropriately depends on balancing legal framework principles against tangible damage prevention,” he noted.
The Path of Stolen Assets
Following the cross-chain migration, the stolen USDC was exchanged for Ether and channeled through Tornado Cash, a privacy-focused protocol designed to mask transaction origins.
Blockchain intelligence provider Elliptic has identified North Korean state-affiliated hackers as the probable culprits. Elliptic observed that the attackers executed more than 100 transactions using Circle’s bridging infrastructure during standard US operating hours.
The Drift Protocol breach eliminated a substantial portion of the platform’s total value locked and created shockwaves throughout several DeFi ecosystems.
CRCL stock experienced a 1.84% movement in response to these developments.


