Drift investors sue Circle over $280M stolen USDC

A group of Drift Protocol users filed a class action Tuesday against Circle Internet Financial, alleging the company did not freeze roughly $280 million in USDC stolen in an April 1 exploit on the Solana blockchain. The suit was filed by law firm Gibbs Mura on behalf of investors who lost funds in the attack.

The complaint says Circle had both the technical means and contractual authority to block or freeze the tokens but did not act, allowing the attacker to move large sums off Solana. Drift reported that the attacker gained unauthorized access, introduced a malicious asset, disabled withdrawal limits and drained the platform's liquidity.

On-chain tracking cited in the complaint shows the attacker moved more than $230 million in USDC from Solana to Ethereum using Circle's cross-chain transfer protocol. On-chain investigator ZachXBT wrote on social media, “[Six] hours is how long Circle had to freeze stolen funds from the $280M+ Drift hack.”

The complaint also notes that Circle froze 16 unrelated wallets nine days earlier in a separate civil matter, a fact plaintiffs cite as evidence of the company's capacity to intervene.

Circle CEO Jeremy Allaire defended the company's policy at a press conference, arguing the firm freezes USDC wallets only at the direction of law enforcement or courts. He warned unilateral action could create a “significant moral quandary” and called it “a very risky proposition” to act outside established legal process.

Drift announced a proposed recovery package that includes up to $127.5 million from Tether and $20 million from other partners to help affected users and support a relaunch as a USDT-based perpetual derivatives exchange on Solana.

The class action alleges negligence and seeks to hold Circle accountable for failing to prevent the rapid cross-chain movement of the stolen tokens. Legal proceedings are in early stages. The lawsuit concerns how centralized stablecoin issuers and stablecoin governance interact with decentralized platforms and law enforcement during large-scale exploits.