A class-action lawsuit has been filed against Circle Internet Group (issuer of USDC) over its handling of the April 1 Drift Protocol hack on Solana.
On April 1, 2026, hackers widely attributed by blockchain analytics firm Elliptic to North Korean state-sponsored actors, likely Lazarus Group exploited Drift Protocol, a Solana-based DeFi platform, draining roughly $280–285 million in user funds—mostly in USDC and other assets from trading, lending, and vaults. This ranks as one of the largest crypto exploits of 2026.
The attackers then converted and moved a significant portion—approximately $230 million in stolen USDC—from Solana to Ethereum. They did this via Circle’s own Cross-Chain Transfer Protocol (CCTP) in over 100 transactions spanning 6–8 hours during U.S. business hours. Circle did not freeze the funds during this window.
ccn.com
The lawsuit filed in U.S. District Court in Massachusetts by Gibbs Mura, A Law Group. Lead plaintiff is Drift investor Joshua McCollum, representing a proposed class of over 100 affected users. Circle had the technical and contractual ability through its USDC policies and CCTP to freeze the stolen funds but failed to act. This allegedly allowed the hackers to launder the proceeds, deepening investor losses.
Register for Tekedia Mini-MBA edition 20 (June 8 – Sept 5, 2026).
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
Register for Tekedia AI Lab.
Claims include negligence and aiding and abetting conversion of stolen property. Plaintiffs argue Circle’s inaction was especially glaring because it has frozen civilian wallets quickly in the past when directed by authorities. Drift Protocol itself has signaled it may abandon USDC for settlements post-hack possibly switching to USDT. Circle has consistently stated it only freezes USDC upon a valid law enforcement request or court order—not unilaterally.
CEO Jeremy Allaire and Chief Strategy Officer Dante Disparte have defended this publicly after the hack, calling unilateral action a moral quandary that could expose the company to legal risks and undermine trust in stablecoins as rule-of-law assets. They’ve advocated for clearer regulatory frameworks and liability protections for issuers. Critics contrasted this with faster freezes by Tether in similar cases and pointed out Circle’s CCTP infrastructure was actively used by the attackers.
Circle’s Cross-Chain Transfer Protocol (CCTP) is a permissionless, on-chain messaging protocol designed specifically for moving native USDC between supported blockchains. It uses a burn-and-mint mechanism instead of traditional lock-and-mint bridges, eliminating liquidity pools, wrapped tokens, custodians, or third-party fillers. This keeps the total USDC supply constant and unified across chains while minimizing capital inefficiency and bridge-related risks.
CCTP is currently on V2; the canonical version as of 2026. V1 is legacy, limited to slower Standard transfers only, and is scheduled for full deprecation; contracts paused after July 31, 2026. V2 adds Fast Transfers, programmable Hooks, broader chain support including Solana, Ethereum, Arbitrum, Base, Avalanche, Polygon, and others, and improved speed and composability.
USDC’s blacklisting and freeze capability is a feature for compliance; anti-money laundering, sanctions but creates liability if not used aggressively enough in hacks. This suit tests where the line is. North Korea lnk: If confirmed, it ties into broader U.S. concerns about state-sponsored crypto theft funding regimes. A win for plaintiffs could pressure all stablecoin issuers to act faster on hacks—or face lawsuits. It also highlights tensions in centralized vs. decentralized finance.
Circle has not yet issued a public comment specifically on the new lawsuit filing. The case is in early stages—expect motions to dismiss and details on what real-time alerts Circle received from investigators or law enforcement. This is classic crypto drama: innovation meets real-world legal accountability. The outcome could shape how stablecoin issuers balance compliance, user protection, and operational speed in future exploits.