Circle faces lawsuit over $280M Drift hack

TLDR

Circle, issuer of USDC, is facing a class action lawsuit alleging it failed to freeze stolen funds during the roughly $280 million Drift Protocol hack.

1. Plaintiffs say hackers converted and bridged about $230 million in stolen assets into USDC via Circles own cross chain transfer system and Circle did not intervene.
2. The case tests whether stablecoin issuers and bridge operators have a legal duty to use their freeze powers during active exploits, with big implications for DeFi and USDC.
3. Watch how the court defines Circles responsibilities, how regulators respond, and whether more DeFi platforms follow Drift in shifting settlement away from USDC.

Deep Dive

1. What The Lawsuit Claims

On April 1, 2026, Solana based DeFi platform Drift Protocol was exploited, with attackers draining roughly 280 to 285 million dollars using governance and admin transaction abuse on Solana. Blockchain analytics firms and media report that attackers quickly converted a large portion of the loot into USDC and bridged about 230 million dollars through Circles Cross Chain Transfer Protocol over around eight hours and more than 100 transactions, before moving funds on to Ethereum and mixing services like Tornado Cash as detailed here.

A class action in federal court, led by investor Joshua McCollum and law firm Gibbs Mura, alleges Circle was negligent and effectively aided and abetted the conversion by not freezing USDC despite having technical and contractual authority to do so. Plaintiffs point to prior episodes where Circle did freeze wallets, arguing this shows it could have acted to limit harm as summarized here.

2. Why This Matters For USDC, DeFi And Issuers

Circles public position is that it only freezes USDC when legally required by courts or law enforcement, not based on Twitter alerts or private judgments. Executives have warned that unilateral freezes could politicize stablecoin control and undermine trust in USDC as neutral infrastructure, a view echoed by analysts like ARK Invests Lorenzo Valente in defending the no freeze stance after the Drift incident here.

For DeFi users, the case exposes a core tension: centralized issuers and bridges can technically stop flows, but using that power undermines the permissionless ethos, while not using it leaves protocols and LPs exposed. Drift has already removed USDC and is relaunching with Tethers USDT plus a recovery pool, signaling how venue level choices can shift stablecoin market share in response to perceived support during crises.

3. What To Watch Next

The legal theory here is novel: courts must decide whether having technical power to freeze or block cross chain transfers creates a legal obligation to act during hacks. If the plaintiffs win or secure a strong settlement on those grounds, similar claims could target other issuers, bridges and custodial infrastructure providers, effectively turning compliance tools into a regulated emergency response function.

Circle has also flagged a gap between technical capability and regulatory clarity, referencing pending legislation that could define when and how issuers are supposed to intervene during on chain incidents. Parallel to the lawsuit, media report that Drift, Tether and the Solana Foundation are pursuing recovery and relaunch plans, offering a partial backstop but not full restitution.

Conclusion

The Drift exploit itself was a DeFi security failure, but the Circle lawsuit elevates a deeper question about who bears responsibility once stolen funds hit centralized chokepoints. How courts and regulators answer that question could redefine the role of stablecoin issuers and bridges, influencing both which assets DeFi protocols rely on and how trustless users can realistically expect those systems to be in the next big hack.