Key Takeaways
- A proposed class action has been filed against Circle Internet Group in Massachusetts federal court.
- Investors claim Circle neglected to freeze approximately $230M in USDC that was transferred following the April 1 Drift Protocol breach.
- The exploit drained approximately $280M from Drift Protocol, marking it as one of 2026’s most significant DeFi attacks.
- Hackers leveraged Circle’s Cross-Chain Transfer Protocol to relocate assets from Solana to Ethereum throughout multiple hours.
- North Korean state-sponsored threat actors are believed to be responsible for the attack, according to blockchain intelligence provider Elliptic.
Circle Internet Group finds itself facing serious legal challenges. Filed this Wednesday in a Massachusetts federal district court, a proposed class action alleges that the stablecoin company failed to act while cybercriminals transferred approximately $230 million in USDC following what became one of this year’s most devastating cryptocurrency thefts.
Drift Protocol suffered the security breach on April 1, with hackers successfully extracting an estimated $280 million from the decentralized finance ecosystem. The lawsuit focuses on what happened next — a prolonged timeframe during which Circle purportedly observed the stolen assets migrating between blockchain networks without intervention.
Joshua McCollum, an investor in Drift, serves as the lead plaintiff representing over 100 affected parties. The legal filing accuses Circle of both negligence and complicity in facilitating the unlawful transfer of the pilfered cryptocurrency.
The perpetrators exploited Circle’s proprietary Cross-Chain Transfer Protocol to shift the stolen USDC from the Solana network to Ethereum. According to the complaint, Circle possessed both the technological means and contractual rights to immobilize those digital wallets — yet allegedly declined to do so.
“Circle enabled this criminal exploitation of its infrastructure and platforms,” McCollum’s legal representatives stated. “Such significant losses could have been prevented entirely, or at minimum dramatically minimized, had Circle exercised timely intervention.”
The legal team at Mira Gibb is handling representation for McCollum and fellow investors. The court will establish monetary damages during proceedings.
The plaintiffs highlighted a noteworthy comparison: approximately one week prior to the Drift security incident, Circle froze 16 USDC wallets relating to a sealed civil matter in US courts. This previous action, they contend, demonstrates Circle possessed both the capability and willingness to intervene — making their alleged inaction in this case particularly troubling.
Circle’s Position and Industry Perspective
Circle has remained silent regarding the litigation. Cointelegraph contacted the company but has not yet received a statement.
ARK Invest’s digital assets research director, Lorenzo Valente, offered support for Circle’s stance. He contended that freezing cryptocurrency without judicial authorization establishes a troubling precedent — effectively granting private corporations unchecked authority over asset seizure decisions.
“Each subsequent freeze becomes discretionary. Each decision not to freeze becomes a political declaration,” Valente explained. However, he conceded that the stolen assets would probably finance North Korea’s military initiatives.
“Whether Circle made the correct decision depends on how you balance legal framework principles against tangible damage,” he noted.
The Trail of Stolen Assets
Following the cross-chain migration, the pilfered USDC was exchanged for Ether and channeled through Tornado Cash, the transaction obfuscation service, to eliminate traceability.
Blockchain intelligence company Elliptic believes North Korean government-affiliated hackers orchestrated the breach. Elliptic observed that the attackers executed more than 100 transactions through Circle’s bridging infrastructure during standard US working hours.
The Drift Protocol security breach eliminated a substantial portion of the platform’s total value locked and created cascading effects throughout various DeFi ecosystems.
CRCL stock experienced a 1.84% movement in response to the developments.
