Drift Protocol Hack Victims File Class Action Lawsuit Against Circle Over $230M in USDC

Class action targets Circle for inaction during Drift exploit

Joshua McCollum and more than 100 other victims of the Drift Protocol hack have filed a class action lawsuit against Circle in a Massachusetts court. The plaintiffs accuse the USDC issuer of negligence and effectively aiding cybercriminals by failing to block the movement of stolen funds.

According to the complaint, hackers were able to freely transfer approximately $230 million in USDC from Solana to Ethereum via the cross-chain transfer protocol CCTP. McCollum's attorneys stated that Circle allowed criminals to exploit its own infrastructure, and timely intervention could have prevented the losses entirely or reduced them significantly.

The victims are seeking full restitution, with the final amount to be determined by the court.

Why this matters

This lawsuit raises a fundamental question about the accountability of centralized stablecoin issuers. Circle possesses the technical capability to freeze addresses — the plaintiffs' legal team pointed out that roughly one week before the Drift attack, the company froze 16 addresses as part of a sealed civil case in the United States. This precedent, the lawyers argue, demonstrates Circle's ability to act swiftly when it chooses to.

On-chain investigator ZachXBT previously identified at least 15 instances where Circle's slow response cost victims a combined $420 million. He has described the issuer's sluggishness in dealing with illicit USDC transactions as unacceptable.

Circle's defense: law over speed

Circle CEO Jeremy Allaire defended the company's decision not to intervene during a press conference. He explained that wallet freezes are carried out exclusively at the direction of law enforcement, and acting outside established legal procedures in individual cases would create a "serious moral dilemma." Allaire warned that urging Circle to ignore the law and make unilateral decisions represents an extremely risky position.

Industry divided on Circle's stance

Lorenzo Valente, Director of Digital Asset Research at ARK Invest, sided with Circle. He argued that freezing funds without a court order opens the door to arbitrary enforcement.

"Ok, pretty much everyone is mad at @circle and @jerallaire for not freezing the ~$230M in USDC the @DriftProtocol hacker bridged from Solana to Ethereum after the $285M exploit. Let me steelman why it was actually the right call" — Lorenzo Valente (@LorenzoARK), original post

Valente highlighted the paradox: every future freeze would become a subjective decision, while every refusal would be perceived as a political statement. He questioned the criteria for deciding whose funds to block and whose to leave untouched. The researcher did acknowledge that stolen Drift funds could potentially flow toward North Korea's nuclear program, noting that the correctness of the decision "depends on the balance between the rule of law and specific harm."

Bloomberg analyst James Seyffart took the opposite view, calling Circle's arguments a "weak" excuse.

"I hope there's some precedent set. Either you're a decentralized protocol and literally do not have the power to freeze or you're not and you should be freezing hacked funds. This middle ground hand wavy 'only with a court order' stuff is weak. Misses the forest for the trees" — James Seyffart (@JSeyff), original post

Seyffart argued that a clear precedent needs to be established: either a protocol is fully decentralized and physically incapable of freezing assets, or it is centralized — and therefore obligated to block stolen funds.

Drift's recovery efforts

As of the filing, Circle had not commented on the class action. Meanwhile, on April 16, Drift Protocol secured $148 million from Tether and other partners to compensate victims and restore platform operations following the exploit.