Circle Faces Class-Action Over $230M USDC Loss in Drift Hack

Steady attention without excessive speculation.

Background and Context

The events behind the Circle USDC lawsuit trace back to the April 1, 2026 hack of Drift Protocol. Attackers, widely linked to Lazarus Group, executed a long-term social engineering operation. Over several months, they built trust within the ecosystem and eventually gained administrative access.

Once inside, the attackers drained approximately $280–285 million in under 12 minutes. A large portion of the stolen assets included USDC. Shortly after, they bridged over $230 million from Solana to Ethereum using Circle’s infrastructure. They split the transfers into more than 100 transactions over roughly eight hours. Later, they routed funds through mixers such as Tornado Cash to obscure traceability.

Despite this activity occurring during U.S. business hours, Circle did not apply any freeze. This detail has become central to the lawsuit’s argument. Furthermore, this is not the first time Circle has faced scrutiny. On-chain investigator ZachXBT highlighted multiple prior cases where the company delayed or failed to freeze illicit USDC. His report, often referred to as the “Circle Files,” outlines at least 15 incidents since 2022 involving over $420 million in questionable funds.

For example, during the February 2025 Bybit hack, Tether froze linked assets within hours. In contrast, Circle reportedly took about 24 hours. Similar delays appeared in incidents such as the Radiant Capital exploit, the Mango Markets case, and the Nomad Bridge exploit.

As a result, the Drift incident triggered sharp market reactions. Drift’s total value dropped roughly 58 percent, falling from about $550 million to under $250 million. Its native token also declined by 37 percent. At the same time, the broader Solana ecosystem saw capital outflows, with multiple protocols pausing operations or assessing exposure.

Circle’s Response and Freeze Policy

Circle has defended its actions by pointing to its compliance framework. The company states that it freezes USDC only when it receives formal legal orders or directives from law enforcement. According to leadership, discretionary or real-time freezes during hacks could create legal and governance risks.

Jeremy Allaire and Dante Disparte have both emphasized this stance publicly. They argue that unilateral intervention could overstep regulatory boundaries. Therefore, they maintain that Circle operates strictly within established legal processes.

At the same time, Circle has used the situation to push for clearer legislation. The company has referenced proposals such as the GENIUS and CLARITY Acts as necessary frameworks for defining stablecoin issuer responsibilities. However, as of April 17, 2026, Circle has not issued a direct response to the lawsuit itself.

Potential Industry and Legal Implications

This case could become a key precedent for stablecoin accountability. Specifically, it raises questions about whether issuers like Circle must act in real time during cross-chain exploits. It also tests the balance between compliance obligations and user protection.

Legal experts suggest the outcome will depend on whether Circle had both the authority and awareness to freeze funds during the incident. In addition, past inconsistencies in freeze actions could influence the court’s view.

For the broader crypto industry, the implications are significant. First, protocols may reassess their reliance on centralized stablecoin infrastructure. Second, regulators could increase scrutiny around issuer responsibilities and cross-chain monitoring. Finally, if the class action succeeds, it could lead to financial compensation for affected users. It could also push the industry toward stricter security standards and clearer federal oversight of stablecoin controls.