Circle Sued Over Drift Hack: Did It Let $280M Walk Out the Door?

Circle, the company behind the USDC stablecoin, is facing a class action lawsuit from investors who lost money in the $280 million Drift Protocol exploit that took place on April 1. The lawsuit, filed by Drift investor Joshua McCollum on behalf of more than 100 plaintiffs in a US district court in Massachusetts, accuses Circle of allowing attackers to move roughly $230 million in USDC from Solana to Ethereum through its Cross-Chain Transfer Protocol (CCTP) without stepping in to stop it.

"Circle permitted this criminal use of its technology and services," attorneys representing McCollum wrote. "These losses would not have occurred, or would have been substantially reduced, had Circle taken timely action."

How Did the Attackers Pull It Off?

Drift Protocol later confirmed that the attackers spent six months posing as a quantitative trading firm to gain access to the platform. Once inside, they used a technical method called durable nonce accounts to pre-sign transactions, which allowed them to delay the execution of those transactions until the right moment.

The results were swift and severe:

• Attackers drained an estimated $280 to $285 million from the Solana-based exchange in under 12 minutes.
• The stolen funds were then moved from Solana to Ethereum over approximately eight hours using Circle's CCTP.
• Drift's total value locked (TVL) dropped sharply from roughly $550 million to under $250 million.
• At least 20 other DeFi protocols reported indirect losses tied to their exposure to Drift.

On-chain investigator ZachXBT also publicly criticized Circle for not intervening during the multi-hour transfer window, which allegedly occurred during US business hours.

What Is CCTP and Why Does It Matter Here?

Circle's Cross-Chain Transfer Protocol (CCTP) is a native USDC transfer system that allows USDC to be burned on one blockchain and minted on another. It is designed to move stablecoins across chains without relying on third-party bridges. In this case, plaintiffs argue that CCTP was the exact mechanism used to move stolen funds from Solana to Ethereum, and that Circle could have intervened to stop those transfers.

What Does the Lawsuit Actually Allege?

The complaint, filed by the law firm Gibbs Mura, levels two core legal accusations against Circle: aiding and abetting conversion, and negligence. In legal terms, conversion refers to the unauthorized taking or use of someone else's property. Plaintiffs argue Circle's inaction effectively allowed that to happen on a massive scale.

The filing highlights that the alleged transfers occurred during US business hours. It also points to a separate incident that took place nine days before the Drift-related lawsuit: Circle reportedly froze 16 unrelated business wallets in a different matter. According to the plaintiffs, this proves Circle has both the capability and the willingness to freeze funds when it chooses to act. 

The lawsuit argues that Circle did not apply that same capability during the Drift exploit, even though the funds were being moved over several hours. Mira Gibb, the law firm representing McCollum and other Drift investors, is seeking damages, with the final amount to be determined at trial.

How Did Circle Respond?

Earlier this week, Circle CEO Jeremy Allaire, stated that Circle only freezes USDC when directed to do so by formal law enforcement or a court order. According to Allaire, unilateral decisions to freeze funds create what he described as "moral quandaries" and expose the company to legal risk.

"If there are others that believe that Circle should just step away from what the law says and do its own, make its own decisions, I think it's a very risky proposition," Allaire said.

Allaire also called for clearer legal frameworks, citing proposed legislation like the CLARITY Act as a path toward defining what stablecoin issuers are actually responsible for in situations like this. The case sits in a grey area: crypto companies that issue stablecoins may have the technical ability to freeze assets, but the legal authority to do so without a court order is unclear.

What Happened to Drift After the Hack?

In response to the exploit, Drift suspended deposits and withdrawals indefinitely. The protocol later announced a $150 million recovery plan developed in partnership with Tether. As part of that plan, Drift said it is shifting from USDC to USDT as its primary settlement asset, a direct consequence of the hack and the subsequent fallout with Circle.

What Is the Impact on Circle's Stock?

Circle's stock (CRCL) came under pressure following the Drift exploit and the subsequent lawsuit news. On Thursday, CRCL closed 1.84% higher at $107.46, with Allaire separately noting potential opportunities around a yuan-backed stablecoin. However, the stock fell 1.42% in after-market trading as the lawsuit gained media attention. The intraday range was $101.75 to $108.02, and trading volume came in below the average of 12 million shares.

Conclusion

The lawsuit against Circle over the Drift Protocol hack puts a sharp focus on how much responsibility stablecoin issuers carry when their technology is used to move stolen funds. Circle has the technical tools to freeze USDC and block cross-chain transfers, and plaintiffs argue it should have used them. Circle says it cannot act without a legal order. That tension is now playing out in a Massachusetts federal court, and the outcome could set a precedent for how stablecoin companies handle future exploits in real time.

Resources

1. Statement from Lawyers: Class Action Filed Over Drift Protocol $280 Million Hack By Gibbs Mura, A Law Group

2. Report by The Block: Circle CEO Allaire defends decision not to freeze USDC in Drift exploit, citing 'moral quandary'

3. Report by CoinTelegraph: Stablecoin issuer Circle faces lawsuit over $280M Drift Protocol hack

4. Drift Protocol on X: Post on March 5

5. PeckShield on X: Posts (April 1-2)