Circle Internet Group has been hit with a class action suit after a $280 million exploit drained funds from the Drift Protocol on April 1. Plaintiff Joshua McCollum, representing more than 100 Drift investors, filed the complaint in U.S. District Court in Massachusetts, alleging Circle failed to stop attackers from moving roughly $230 million in USDC from Solana to Ethereum using Circle’s Cross-Chain Transfer Protocol (CCTP) over several hours.
McCollum’s lawyers contend Circle “permitted this criminal use of its technology and services,” and say the losses “would not have occurred, or would have been substantially reduced, had Circle taken timely action.” The complaint accuses Circle of aiding and abetting conversion and negligence. The plaintiffs are represented by the law firm Mira Gibb and seek damages to be decided at trial.
The case underscores a legal gray area for crypto companies that retain technical control over on-chain assets. While firms like Circle may have the technical ability to intervene or freeze tokens, they frequently point to regulatory constraints or the absence of immediate legal authority as reasons not to act during live exploits. That tension raises questions about who bears responsibility as events unfold in real time.
Plaintiffs note that Circle froze 16 USDC wallets in connection with a sealed U.S. civil case roughly a week before the Drift incident, arguing this shows Circle had the capacity to block transactions when it chose to do so. Cointelegraph contacted Circle for comment but did not receive an immediate response.
Blockchain analytics firm Elliptic has indicated the exploit was carried out by actors linked to North Korea, observing more than 100 transactions routed over Circle’s bridge during U.S. working hours. Reports say the stolen USDC was converted to Ether and routed through the Tornado Cash privacy service to obscure the trail.
Lorenzo Valente, research director at ARK Invest, warned that blanket or unilateral freezes could set a troubling precedent. “Every future freeze is now a judgment call. Every non-freeze is a political statement,” he said, arguing Circle may have been justified in refusing to act without formal legal process. Valente acknowledged there is reasonable disagreement over balancing rule-of-law principles against immediate harm and speculated that proceeds could potentially support North Korea’s weapons programs.
The suit will test how courts assign responsibility when intermediaries control on-chain mechanisms but must also navigate regulatory and legal limits. Plaintiffs say Circle’s prior freezes demonstrate capability; Circle’s defenders say acting without process risks arbitrary decisions and legal exposure.
Cointelegraph is committed to independent, transparent reporting. This article follows that editorial policy; readers are encouraged to verify details independently as the case proceeds.