Circle Internet Financial, the issuer of the USDC stablecoin, has been hit with a proposed class-action lawsuit in Massachusetts federal district court over its failure to freeze roughly $230 million in USDC stolen during the April 1 Drift Protocol hack. The complaint, filed April 17 by lead plaintiff Joshua McCollum on behalf of more than 100 affected investors, alleges Circle had the technical ability and contractual authority to halt the movement of stolen stablecoins but declined to act during an eight-hour window as attackers bridged funds from Solana to Ethereum. Circle’s publicly traded parent, CRCL, moved 1.84 percent on the news. The case puts a legal weight behind a question the industry has argued about for weeks: when a regulated stablecoin issuer can see illicit funds flowing through its own infrastructure, does it have a duty to stop them?
The Cross-Chain Transfer Protocol, or CCTP, is Circle’s native bridge that lets USDC move between blockchains by burning tokens on one chain and minting fresh ones on another, all under Circle’s operational control.
Key takeaways
- A class-action lawsuit was filed April 17, 2026 in U.S. District Court in Massachusetts against Circle Internet Financial over the April 1 Drift Protocol hack.
- Plaintiffs allege Circle failed to freeze roughly $230 million in USDC as attackers moved the funds from Solana to Ethereum via Circle’s own Cross-Chain Transfer Protocol.
- The complaint cites Circle freezing 16 USDC wallets the prior week in a sealed civil case as evidence the issuer has both the capability and precedent to intervene.
- Circle declined to comment. CEO Jeremy Allaire has said in recent weeks that USDC freezes should require a court order or law enforcement request.
Published: April 18, 2026, 16:00 UTC
How the Drift hack unfolded
Drift Protocol, a Solana-based decentralized perpetuals exchange, was drained of about $280 million on April 1, 2026 in what Elliptic and Drift’s own post-mortem have described as a suspected DPRK-linked attack. The initial exploit took roughly 12 minutes to execute. Within an hour, on-chain analysts including ZachXBT had flagged the theft on X. Over the following eight hours, the attacker moved approximately $230 million of the stolen balance out of Solana and into Ethereum using CCTP, then converted the funds into ether and routed them through Tornado Cash and other mixers.
The Drift exploit is the largest DeFi hack of 2026 to date and the second-largest Solana incident on record after the 2022 Wormhole breach. Tether committed $128 million earlier this week to help Drift relaunch, a backstop that underlines how central stablecoin issuers have become to the DeFi cleanup process.
The selective-enforcement claim
The complaint’s sharpest allegation is not that Circle lacked the power to freeze the wallets, but that it chose not to. Plaintiffs point to a sealed U.S. civil matter the prior week in which Circle froze 16 USDC addresses. That action, the filing argues, establishes both the technical capacity and a recent precedent for intervention, which the company then failed to apply during a public, widely flagged theft.
The suit brings claims of negligence and aiding and abetting unlawful conversion. It asks the court to certify a class of investors whose funds were affected. Circle has not responded to the filing publicly, and its legal answer is not yet on the docket.
Why it matters for the USDC model
CEO Jeremy Allaire told reporters earlier this month that Circle will only freeze USDC in response to a court order or a law enforcement request, not at its own discretion during a live exploit. His argument is that an issuer deciding unilaterally whose coins to blacklist is itself a systemic risk, and that aligning with legal process is what makes USDC compatible with banks, payment networks, and public-market reporting.
Tether takes a different line. The company has repeatedly frozen USDT tied to hacks and sanctions within hours, including on the TRON addresses involved in the recent Grinex incident. Critics of Circle, including ZachXBT, have argued that the issuer’s restraint has cost victims more than $420 million in stolen stablecoins since 2022. Omid Malekan of Columbia Business School has pushed back, warning that handing issuers discretionary freeze power at the request of social media would erode the neutrality that DeFi depends on.
What comes next
The suit lands at a delicate moment for Circle. The GENIUS Act framework the company helped shape is still being implemented by the FDIC, FinCEN, and OFAC, and the SEC’s recent guidance moved USDC closer to cash-equivalent status on bank balance sheets. A negligence finding, or even a high-profile settlement, could complicate that trajectory by establishing that issuer liability extends beyond acting on formal legal requests.
Expect three things in the near term. Circle is likely to move to dismiss on the basis that no common-law duty to freeze exists absent a court order. Other plaintiffs, including Drift users themselves, may file similar actions in other jurisdictions. And policymakers working on stablecoin rules will have a concrete fact pattern to litigate the issuer-duty question, rather than a hypothetical.
Frequently asked questions
Why didn’t Circle just freeze the stolen USDC during the Drift hack?
Circle CEO Jeremy Allaire has said the company will only blacklist USDC wallets after a court order or a direct law enforcement request, not on its own reading of a live incident. The policy is meant to align USDC with how regulated financial institutions handle asset freezes and to avoid setting a precedent of discretionary blacklisting.
What is the Cross-Chain Transfer Protocol?
CCTP is Circle’s native bridge for USDC. Instead of locking tokens on one chain and wrapping them on another, it burns USDC on the origin chain and mints a fresh, native supply on the destination chain. The attacker in the Drift case used CCTP to move about $230 million of stolen USDC from Solana to Ethereum over roughly eight hours.
How could this lawsuit affect CRCL stock and other stablecoin issuers?
A ruling that Circle owed a duty to act on publicly visible theft, even without a court order, would raise compliance costs for every regulated issuer and could pressure competitors like Tether and PayPal’s PYUSD to formalize freeze policies. CRCL stock moved 1.84 percent on the filing, and analysts expect the legal theory itself, more than the damages, to drive the next round of price action.
