A major lawsuit filed in Massachusetts on April 15, 2026, accuses stablecoin issuer Circle of failing to act during one of 2025’s largest crypto hacks. The legal action centers on Circle’s alleged inaction as attackers moved $230 million in stolen USDC from the Solana-based Drift Protocol.
The Core of the Circle Lawsuit
According to court documents, the class action lawsuit was filed by Drift Protocol investor Joshua McCollum. It represents over 100 members. The suit alleges Circle was negligent and aided in the conversion of stolen funds. The central claim is that Circle did not freeze the stolen USDC as it was transferred across blockchains using Circle’s own technology.
Also read: RAVE Token Scandal: RaveDAO Denies Manipulation as Binance, Bitget Launch Urgent Probe
Attorneys for the plaintiffs wrote that Circle “permitted this criminal use of its technology and services.” They argue the losses “would not have occurred, or would have been substantially reduced, had Circle taken timely action.” The legal filing points to a specific technical process. Attackers used Circle’s Cross-Chain Transfer Protocol (CCTP) to move funds from Solana to Ethereum. This transfer happened over several hours during U.S. business hours on April 1, 2025.
A Precedent for Freezing Funds
The lawsuit highlights a critical precedent. McCollum’s lawyers noted that about a week before the Drift incident, Circle froze 16 USDC wallets. This action was connected to a sealed U.S. civil case. The legal team uses this to argue Circle possessed the technical capability to freeze the Drift hacker’s funds. They claim Circle chose not to use it.
Also read: Kelp Restaking Platform Hit by Devastating $293M Exploit, Triggering DeFi Contagion
This contrast is a key pillar of the negligence claim. It suggests a selective application of Circle’s power to control its stablecoin. The case directly challenges a common industry stance. Many crypto firms cite a lack of immediate legal authority to freeze assets during fast-moving exploits.
The Broader Legal Grey Area
This lawsuit touches a fundamental tension in decentralized finance. Companies that issue centralized stablecoins like USDC retain ultimate control over the asset. But their responsibility to intervene during crimes is not clearly defined by law. Industry watchers note this case could help establish that responsibility.
“The implication is significant,” said one legal analyst familiar with crypto cases. “If a company has the technical power to stop a theft in progress, a court may decide it has a duty to use it. This could reshape how stablecoin issuers operate during crises.” The lawsuit seeks damages, with the final amount to be determined at trial.
Tracking the Stolen Funds
Data from blockchain analytics firm Elliptic provided key context for the hack. Elliptic suspected the exploit was committed by North Korean state-backed hackers, specifically the Lazarus Group. Their analysis showed the hackers made over 100 transactions via Circle’s bridging technology.
After converting the USDC to Ether (ETH), the funds were sent through the Tornado Cash privacy protocol. This step was taken to launder the proceeds and obscure the money trail. The scale and sophistication of the operation pointed to a well-resourced, nation-state actor. This detail adds gravity to the lawsuit’s claims about the consequences of inaction.
A Divided Industry Response
Circle’s decision not to freeze the funds sparked intense debate. The company faced immediate backlash from parts of the crypto community affected by the hack. However, some analysts defended the move as necessary to uphold principle.
Lorenzo Valente, director of research for digital assets at ARK Invest, argued Circle made the right choice. He stated that freezing funds without a legal order opens the door for arbitrary discretion. “Every future freeze is now a judgment call. Every non-freeze is a political statement,” Valente said. He posed difficult questions: “Why freeze the Drift hacker but not that sketchy Nigerian fraud wallet?”
Valente acknowledged the harsh reality. He speculated the stolen funds would likely fund North Korea’s nuclear weapons program. “Whether Circle got it right comes down to how much you weigh rule-of-law principles vs concrete harm. Reasonable people disagree,” he concluded. This division shows the complex balance crypto custodians must strike.
What This Means for Stablecoins
The Circle lawsuit could set a major legal standard. Its outcome may define the duties of stablecoin issuers during hacks. For investors, the case highlights a key risk. The value proposition of a “stable” asset managed by a centralized entity includes an expectation of security and recourse. This lawsuit tests the limits of that expectation.
For the industry, the stakes are high. A ruling against Circle might force issuers to adopt more aggressive intervention policies. This could increase protection for users but also centralize power further. It might also create legal liability for issuers who fail to act during future exploits. Conversely, a ruling for Circle could cement the current hands-off approach during real-time attacks.
This suggests a period of uncertainty for stablecoin regulation. Policymakers are already scrutinizing the sector. A high-profile case like this one provides concrete material for legislative debates. The final court decision will be closely watched by regulators worldwide.
Conclusion
The Circle lawsuit over the $230 million Drift Protocol hack represents a major moment for crypto accountability. It challenges the passive role often adopted by infrastructure providers during major thefts. The case’s resolution will influence how stablecoin issuers, bridges, and other centralized services respond to exploits. It also forces a difficult conversation about the trade-offs between protocol neutrality and user protection in the digital asset space.
FAQs
Q1: What is Circle being sued for?
Circle is facing a class action lawsuit alleging negligence and aiding the conversion of stolen funds. The plaintiffs claim Circle should have frozen $230 million in USDC stolen from the Drift Protocol in April 2025 as it was transferred using Circle’s own cross-chain bridge.
Q2: Who filed the lawsuit against Circle?
The lawsuit was filed by Drift Protocol investor Joshua McCollum on behalf of over 100 members in a U.S. district court in Massachusetts on April 15, 2026.
Q3: Why does the lawsuit claim Circle could have frozen the funds?
The lawsuit points out that Circle froze 16 USDC wallets in a separate, sealed case just one week before the Drift hack. This action is cited as proof that Circle had the technical capability to freeze the stolen Drift funds but chose not to.
Q4: Who is suspected of carrying out the Drift Protocol hack?
Blockchain analytics firm Elliptic suspected the exploit was committed by North Korean state-backed hackers, likely the Lazarus Group.
Q5: What could be the wider impact of this lawsuit?
The case could establish new legal duties for stablecoin issuers and centralized crypto services during hacks. A ruling against Circle might force companies to intervene more actively, potentially increasing user protection but also concentrating power and liability.
This article was produced with AI assistance and reviewed by our editorial team for accuracy and quality.
Be the first to comment