Stablecoin issuer Circle faces lawsuit over $230M Drift Protocol hack

Circle Internet Group is facing a class action lawsuit led by a Drift Protocol investor claiming it failed to freeze funds stolen in a $280 million exploit of the protocol on April 1.

The lawsuit was filed by Drift investor Joshua McCollum on behalf of over 100 members in a US district court in Massachusetts on Wednesday, which accused Circle of allowing the attackers to transfer about $230 million worth of USDC (USDC) from Solana to Ethereum via Circle’s Cross-Chain Transfer Protocol (CCTP) over several hours without intervention.

“Circle permitted this criminal use of its technology and services,” attorneys representing McCollum wrote, adding: “These losses would not have occurred, or would have been substantially reduced, had Circle taken timely action.”

The suit accuses Circle of aiding and abetting conversion as well as negligence. Mira Gibb, the law firm representing McCollum and other Drift investors, is seeking damages, with the final amount to be determined at trial.

The case touches on a legal grey area around crypto companies that retain control over user funds. While such companies may have the technical ability to intervene or freeze assets, they often cite regulatory constraints or the lack of immediate legal authority as reasons for inaction — leaving accountability unclear as exploits unfold in real-time.

Source: James Seyffart

McCollum’s lawyers pointed out that Circle froze 16 USDC wallets in connection with a sealed US civil case about a week before the Drift incident to argue that Circle had the technical capacity to do the same.

Cointelegraph reached out to Circle for comment, but didn’t receive an immediate response.

Crypto analytics firm Elliptic suspected the exploit was committed by North Korean state-backed hackers, who made over 100 transactions via Circle’s bridging technology during US working hours, where the is based.