On April 1, attackers hit Drift Protocol — one of the largest perpetual DEXes on Solana. In roughly 12 minutes, $280–$285 million was drained. Then, over the next eight hours, $230 million of it was quietly walked out through Circle's own infrastructure.
Now Circle is being sued for watching it happen.
Circle, the issuer behind USDC, is facing a class action lawsuit in Massachusetts tied to the $280 million Drift Protocol hack. The complaint alleges Circle did not take action to freeze stolen funds even though it had both the technical ability and contractual authority to do so. According to the lawsuit, attackers drained an estimated $280–$285 million from the Solana-based exchange in less than 12 minutes. The stolen assets were then moved from Solana to Ethereum over roughly eight hours using Circle's Cross-Chain Transfer Protocol.
"Circle permitted this criminal use of its technology and services," attorneys representing plaintiffs wrote. "These losses would not have occurred, or would have been substantially reduced, had Circle taken timely action."
The lawsuit points to something damning: just one week before the Drift hack, Circle froze 16 USDC wallets in connection with a sealed US civil case — proving the company had the technical capacity to freeze assets. Analysts tracked more than 100 transfers via Circle's bridge infrastructure during US business hours. Fantom And yet, during the Drift hack, over eight hours of active fund movement: nothing.
Elliptic flagged the incident as likely linked to North Korean state-backed actors. Investigators later tracked portions of the proceeds through Tornado Cash after funds were converted into Ether on Ethereum.
Here's the hard philosophical question this lawsuit puts on the table — and it's one the whole industry needs to wrestle with. ARK Invest's director of digital asset research, Lorenzo Valente, argued that Circle's decision not to freeze funds during the exploit may have been justified under rule-of-law considerations: "Every future freeze is now a judgment call. Every non-freeze is a political statement. Why freeze the Drift hacker but not that sketchy Nigerian fraud wallet? Why this protester but not that one?"
That tension is real. If USDC can be frozen at will by Circle, is it really decentralized money? If it can't be frozen during an active North Korean hack, is the infrastructure responsible? There's no clean answer. But this lawsuit will force one into existence through the courts — and whatever the outcome, it will define the legal obligations of stablecoin issuers globally for years.
Tether stepped in with a $127.5 million recovery commitment to help Drift relaunch using USDT as its settlement layer — explicitly replacing USDC. Drift is pivoting away from Circle's infrastructure entirely.
The legal battle is just beginning. The consequences are already here.
#Circle #USDC #DriftProtocol #DeFiHack #CryptoSecurity