Drift Investors Sue Circle Over USDC Transfers After Protocol Exploit

Circle is facing fresh scrutiny after Drift Protocol investors filed a proposed class action tied to the platform’s April 1 exploit. The lawsuit argues that the stablecoin issuer failed to stop roughly $230 million in stolen USDC from moving across chains through Circle’s own infrastructure. Plaintiffs say the company had the technical ability to intervene.

The case was filed on April 14 in federal court in Massachusetts by investor Joshua McCollum on behalf of more than 100 affected users. At the center of the complaint is Circle’s Cross-Chain Transfer Protocol, or CCTP. Plaintiffs say it was used to bridge stolen USDC from Solana to Ethereum over a period of several hours after the exploit.

What the lawsuit against Circle alleges

The complaint does not accuse Circle of causing the exploit itself. Instead, it claims the company failed to act once the attack was underway. It allowed hackers to continue moving funds without disruption. According to the filing, a significant portion of the stolen assets remained in USDC. Those funds could have been frozen before being fully dispersed.

That distinction shifts the focus to post-incident responsibility. The Circle lawsuit raises the question of whether a stablecoin issuer that can blacklist or freeze tokens should be expected to act during an ongoing exploit. This is especially relevant when its own infrastructure is involved.

>>> Related: Drift Protocol Hack Triggers $270M+ Outflow Crisis

Circle’s position on freezing funds

Circle had already addressed the broader debate before the case was filed. In an April 10 blog post, the company said it freezes USDC only when required by law. It does so through lawful process by an appropriate authority. It argued that having the technical power to freeze funds is not the same as having the legal authority to do so whenever the market demands it.

That response gives the dispute a wider policy dimension. Critics see the Drift episode as proof that regulated stablecoin issuers can act quickly but sometimes choose not to. Circle, by contrast, is arguing that unilateral intervention without legal compulsion would create a different set of risks. These include due process, property rights, and arbitrary enforcement.

Why the dollar figures differ

Reported estimates of the exploit vary across sources. Circle referenced losses exceeding $270 million, while the law firm behind the class action described the incident as a $280 million breach. Some coverage places the total as high as $285 million.

The differences likely reflect how the stolen assets were valued at different points in time. They may also depend on which funds were included in the total. Across reports, the consensus is that the exploit ranks among the larger DeFi breaches of the year.

>>> Read more: Drift Protocol Hack Cause Linked to North Korea, Bybit Parallels

Drift has already moved on from USDC

The market impact is already extending beyond the courtroom. Drift announced a recovery plan backed by up to nearly $150 million from Tether and other partners. It said its relaunch will migrate settlement from USDC to USDT. The move suggests the fallout is no longer just legal. It is also competitive, with trust in stablecoin infrastructure now part of the story.

That is why this Circle lawsuit could matter beyond one hack. Even if the plaintiffs still have to prove their claims in court, the case sharpens a bigger question for crypto markets. When stolen funds are moving in real time, should stablecoin issuers be treated as neutral infrastructure providers, or as gatekeepers with a duty to act?