- Circle has been sued for its sluggish response to the hack of the Solana-based decentralised exchange Drift Protocol.
- The company “did nothing as the attackers worked to offload their spoils,” the lawsuit reads.
- Circle’s CEO said the company only acts when it receives a court order.
Circle’s sluggish reaction to an April Fools’ Day heist helped North Korean hackers make off with $230 million in stolen crypto, a new class action lawsuit alleges.
On April 1, hackers drained over $295 million from Drift, a Solana-based trading platform. It was the largest hack of a decentralised finance protocol so far in 2026. Investigators have since attributed it to North Korean cybercriminals.
While Drift lost some $295 million in crypto, the hackers made off with just $230 million because other, smaller companies were able to freeze some of the stolen assets.
And the hackers couldn’t have pulled it off without Circle’s help, a former Drift Protocol trader alleged.
Circle “did nothing as the attackers worked to offload their spoils,” the lawsuit reads. “For hours, Circle knowingly permitted the attackers use of its technology and services, despite its ability to freeze the assets and stop the exodus into Ether.”
USDC is the world’s second-largest stablecoin. Circle mints USDC and has the power to freeze it, preventing specific wallet addresses from transferring or receiving the tokens.
The hackers converted various cryptocurrencies pilfered from Drift into USDC, according to the lawsuit. They then used Circle’s cross-chain transfer protocol, or CCTP, to move the stablecoins from the Solana blockchain to Ethereum.
There, they converted USDC into Ether, which cannot be frozen or seized by third parties.
Eight-hour getaway
Within an hour, crypto influencers began tagging Circle in social media posts, alerting them to the ongoing exploit.
“Though the taking was swift, the getaway was not,” the lawsuit reads. “This offloading process, which relied on Circle’s stablecoin USDC and its blockchain bridge CCTP, took approximately eight hours.”
The lawsuit alleges Circle aided and abetted the hackers and was negligent in its behaviour.
“Circle itself had a duty to monitor suspicious activity on its CCTP, whose sole purpose is money transmission, under the Bank Secrecy Act,” it adds.
The lawsuit was filed "on behalf of Drift Protocol investors” earlier this week in federal court in Massachusetts by Missouri resident Joshua McCollum, who had crypto worth $23,500 in Drift.
The lawsuit said Circle has a long pattern of inaction, which may have emboldened hackers who would otherwise avoid freezable assets such as USDC.
To freeze, or not to freeze?
Critics have assailed Circle for its reaction to the Drift exploit.
Pseudonymous crypto forensics expert ZachXBT collected 15 examples of hacks in which Circle took “minimal action against illicit funds.”
“The decisions they've made around compliance have had real consequences for real people,” he wrote. “They have every tool and resource available to do better. They just haven’t."
Circle did not immediately return DL News’ request for comment.
Earlier this week, however, Circle CEO Jeremy Allaire said the decision to freeze assets shouldn’t be made at the company’s discretion. Instead, it should be made after receiving a court order.
Lorenzo Valente, director of research at ARK Invest, said that was the right call.
“A stablecoin that freezes on Twitter pressure is a stablecoin where anyone loud enough can trigger action,” he wrote on X. “That’s worse, not better.”
But Taylor Monahan, the principal security researcher at crypto wallet MetaMask, said Circle’s chief rival, Tether, has successfully taken a more proactive approach.
Tether’s lifeline
The lawsuit came a day before Tether stepped in to offer Drift Protocol a $128 million lifeline to help the exchange reimburse its users.
But the recovery plan has one condition: Drift would have to use Tether’s USDT as its main stablecoin, rather than Circle’s USDC.
“The recovery plan presents a clear, revenue-driven model that prioritises Drift users from day one,” Tether said in a statement.
“Additionally, as part of the relaunch, Drift will transition its settlement asset from USDC to USDT, bringing more than 128,000 users and over 35 ecosystem teams onto USDT-based trading.”
Tether said it would give Drift $127.5 million as part of the recovery plan. Other unnamed partners will contribute $20 million, the statement said.
Mathew Di Salvo and Aleks Gilbert are correspondents with DL News. Got a tip? Email them at mdisalvo@dlnews.com and aleks@dlnews.com.