The Lawsuit
The class action was filed by Drift Protocol investor Joshua McCollum, represented by law firm Mira Gibb, in a US district court in Massachusetts on April 14. The complaint accuses Circle Internet Financial of aiding and abetting conversion and negligence, arguing that "these losses would not have occurred, or would have been substantially reduced, had Circle taken timely action."
Attorneys for McCollum point out that Circle froze 16 USDC wallets in connection with a sealed US civil case approximately one week before the Drift incident, which they cite as evidence that the company possessed the technical means to act swiftly. During the Drift exploit, hackers transferred roughly $232 million in USDC across more than 100 transactions via Circle's Cross-Chain Transfer Protocol over an eight-hour window spanning US working hours. The funds were subsequently converted to Ether and routed through Tornado Cash.
The Attack
The April 1 exploit drained $285 million from Drift Protocol, a Solana-based decentralised finance platform. Hackers had infiltrated the company over six months while posing as a quantitative trading firm, and weaponised a legitimate Solana feature called "durable nonces" to execute pre-signed administrative transfers. Drift Protocol subsequently attributed the attack to North Korean state-affiliated hackers, an assessment echoed by crypto analytics firm Elliptic. ARK Invest's director of research for digital assets, Lorenzo Valente, speculated that the proceeds are likely funding North Korea's nuclear weapons programme.
Circle's Defence
Circle has stated it operates as a regulated company that complies only with sanctions, law enforcement orders, and court-mandated requirements. CEO Jeremy Allaire warned that unilateral freezing decisions outside established legal processes would create a "significant moral quandary." Chief Strategy Officer Dante Disparte reinforced this in a public blog post, stating that Circle freezes USDC only because "the law requires us to act."
ARK Invest's Valente offered qualified support for Circle's position, arguing that a discretionary freeze would set a precedent requiring the company to justify every subsequent decision to freeze or not freeze a wallet: "Every future freeze is now a judgment call. Every non-freeze is a political statement."
Industry Fallout
Blockchain investigator ZachXBT publicly accused Circle of having been "asleep" during the incident and questioned why crypto businesses should continue to build on Circle's infrastructure if a protocol with nine-figure total value locked could not obtain support during a major exploit. ZachXBT has separately documented approximately $420 million in suspicious USDC flows since 2022 that went unblocked by Circle, while TRM Labs data shows around $141 billion in stablecoin transactions last year were linked to illicit activity.
Drift Protocol has since secured recovery commitments of up to $127.5 million from Tether and $20 million from other partners. Tether CEO Paolo Ardoino positioned the commitment as evidence of his firm's greater responsiveness during industry crises. The amount of damages sought by McCollum's legal team is to be determined at trial.
