The decentralized finance sector has been rocked by another massive exploit, and this time, the legal fallout is targeting one of the biggest names in the industry. Circle Internet Group, the company behind the popular USDC stablecoin, is currently facing a class-action lawsuit. Led by Drift Protocol investor Joshua McCollum, the legal action claims that Circle failed to intervene and freeze funds stolen during a staggering $280 million hack of the protocol on April 1.
Filed in a United States district court in Massachusetts, the lawsuit represents over 100 affected members. According to the filing, attackers managed to transfer roughly $230 million worth of USDC from the Solana network over to Ethereum. They accomplished this using Circle’s Cross-Chain Transfer Protocol over a span of several hours. McCollum’s legal team argues that Circle had ample time to step in but simply stood by without taking action, effectively allowing criminals to use its technology and services to escape with the funds.
Accusations of Negligence and Aiding the Attackers
The core of the lawsuit accuses Circle of both negligence and aiding and abetting the conversion of stolen property. The law firm representing the investors, Mira Gibb, is actively seeking damages, arguing that the financial losses could have been substantially reduced or prevented entirely if Circle had taken timely action. To bolster their case, the plaintiffs point to an incident just one week prior to the Drift exploit, where Circle successfully froze sixteen USDC wallets connected to a separate, sealed civil case. The lawyers argue this clearly proves the stablecoin issuer had the technical capacity to hit the brakes on the hackers.
Adding an international layer of intrigue to the case, crypto analytics firm Elliptic suspects that the heist was carried out by state-backed hackers from North Korea. These cybercriminals reportedly executed over one hundred transactions using Circle’s bridging technology right in the middle of standard American working hours. Eventually, the stolen USDC was converted into Ether and funneled through Tornado Cash, a well-known privacy protocol used to launder crypto proceeds and erase digital footprints. Cointelegraph reached out to Circle regarding the situation, but the company has not provided an immediate public response.
The Complex Reality of Crypto Asset Control
This lawsuit spotlights a massive, unresolved legal gray area hovering over the cryptocurrency industry. While centralized companies like Circle clearly have the technical ability to freeze assets on their networks, they often refrain from doing so without explicit legal authority or regulatory mandates. Acting without a court order can leave a company vulnerable to other legal challenges, making real-time intervention during ongoing exploits an incredibly risky maneuver for their legal departments.
Defending Circle’s inaction, Lorenzo Valente, the director of research for digital assets at ARK Invest, noted that the company was effectively forced into a lose-lose situation. Valente argued that Circle ultimately made the correct decision by not intervening, cautioning that freezing user funds without a formal legal order would open a dangerous door to arbitrary discretion and censorship. As this lawsuit heads to trial, the outcome could drastically reshape the expectations placed on stablecoin issuers regarding security, intervention, and user accountability during future blockchain exploits.
