Circle (CRCL) Sued Over $280M Drift Protocol Hack—What Plaintiffs Claim

Circle (CRCL), the issuer behind the USDC stablecoin, is facing a fresh lawsuit in Massachusetts tied to the $280 million Drift Protocol hack that occurred on April 1. 

The complaint, filed by plaintiffs represented by the law firm Gibbs Mura, alleges that Circle did not take action to freeze stolen funds even though it had both the technical ability and contractual authority to do so.

Drift Hack Fallout

According to the lawsuit, attackers drained an estimated $280–$285 million from the Solana-based exchange in less than 12 minutes. The stolen assets were then moved from Solana to Ethereum over the course of roughly eight hours using Circle’s Cross-Chain Transfer Protocol (CCTP). 

The transfer allegedly took place during US business hours, a detail plaintiffs highlight to emphasize that the alleged movement and conversion of funds occurred while the matter was ongoing, without intervention from Circle to freeze the assets.

The filing further claims that user funds were pulled from multiple parts of Drift’s platform, including trading, lending, and vault deposits. As the breach unfolded, Drift’s total value locked reportedly fell sharply from about $550 million to under $250 million. 

In response to the incident, deposits and withdrawals were suspended indefinitely. The impact, plaintiffs say, extended beyond Drift itself: at least 20 other DeFi protocols reported indirect losses related to exposure to Drift.

Circle Accused Of Not Freezing Assets

The plaintiffs also point to a separate earlier civil matter involving Circle. Nine days before the Drift-related lawsuit, Circle reportedly froze 16 unrelated business wallets. 

That, according to the plaintiffs, demonstrates that Circle has the capability—and, in that instance, the willingness—to freeze funds when it deems it appropriate. 

However, the lawsuit alleges that Circle failed to freeze the stolen USDC and other assets that were allegedly converted into USDC after the hack.

Circle is accused of using its Cross-Chain Transfer Protocol in a way that plaintiffs say allowed attackers to offload up to $230 million onto the Ethereum blockchain. 

In the lawsuit’s framing, this is central to why the plaintiffs believe Circle should have acted to prevent the transfers of stolen stablecoins and connected assets during the time the funds were being moved.