Circle Faces Class Action Over Alleged Failure to Freeze Stolen USDC in $280 Million Drift Exploit

Circle Internet Financial is facing a class action lawsuit from Drift Protocol investors who lost funds in the April 1 exploit, one of the largest DeFi hacks of 2026. The suit, filed by law firm Gibbs Mura on behalf of more than 100 plaintiffs, accuses Circle of failing to freeze stolen USDC as the attacker moved over $230 million across chains using Circle’s own infrastructure.

Plaintiffs Say Circle Could Have Frozen $230 Million in Stolen USDC but Didn’t

The complaint was filed Tuesday in a U.S. district court in Massachusetts by Drift investor Joshua McCollum on behalf of over 100 class members. It accuses Circle of negligence and aiding and abetting conversion by allowing the attacker to bridge more than $230 million in stolen USDC from Solana to Ethereum over roughly six hours via Circle’s Cross-Chain Transfer Protocol (CCTP).

“Circle allegedly took no action to freeze the funds, despite having the technical and contractual authority to do so,” Gibbs Mura said in a statement.

“These losses would not have occurred, or would have been substantially reduced, had Circle taken timely action,” the attorneys representing McCollum wrote in the filing.

Circle Froze 16 Wallets Days Before the Exploit

The lawsuit draws a pointed comparison. Nine days before the Drift exploit, Circle had frozen 16 unrelated wallets in a separate civil matter. The plaintiffs cite that action as evidence that Circle both possessed and was willing to use its freeze authority, making its inaction during a $280 million exploit harder to justify.

On-chain investigator ZachXBT made a similar argument publicly, saying Circle had a six-hour window to freeze the stolen funds and did not act. ZachXBT said the attacker moved the USDC from Solana to Ethereum through Circle’s CCTP during that window.

Allaire Argues Circle Cannot Freeze Wallets Without a Legal Directive

Circle chief executive Jeremy Allaire addressed the criticism at a press conference earlier this week, saying the company only freezes USDC wallets at the direction of law enforcement or the courts and does not act unilaterally in private matters.

“If there are others that believe that Circle should just step away from what the law says and do its own, make its own decisions, I think it’s a very risky proposition,” Allaire said.

Allaire framed the question as a broader governance issue, arguing that taking action outside established legal processes could create what he called a “significant moral quandary” for any stablecoin issuer.

Tether and Partners Commit $147.5 Million to Drift’s Recovery

Attackers spent months posing as a quantitative trading firm before compromising Drift Protocol’s governance, listing a fabricated token as collateral, and raising withdrawal limits. The exploit drained an estimated $280 to $285 million from the Solana-based decentralized exchange in under 12 minutes.

The attack took under 12 minutes to execute once the exploit was triggered. On Thursday, Drift said it had secured a proposed recovery package of up to $127.5 million from Tether and $20 million from other partners, totaling $147.5 million.

“The structure is intended to support user recovery following the April 1 exploit and facilitate Drift’s relaunch as the largest USDT-based perpetual DEX on Solana,” the Drift team stated.