Circle sued over $230M USDC bridge transfers after Drift hack

Joshua McCollum, a Drift investor, filed a class-action complaint in the U.S. District Court for the District of Massachusetts on behalf of more than 100 investors, alleging Circle Internet Group allowed attackers to move roughly $230 million in USDC through its Cross-Chain Transfer Protocol (CCTP) during an April 1 exploit.

The suit accuses Circle of aiding and abetting conversion and of negligence, and seeks damages to be determined at trial. The complaint says the wider attack on the Drift decentralized derivatives protocol resulted in about $280 million in losses, with approximately $230 million routed through Circle’s bridge service.

According to the complaint, attackers used CCTP to move USDC from Solana to Ethereum over a period of hours, then converted the stablecoin into ether and routed funds through the Tornado Cash privacy tool to obscure the trail. Analysts who reviewed the transactions reported a pattern and timing that they said were consistent with transfers by state-backed North Korean actors; the complaint notes more than 100 transfers via the bridge during U.S. business hours.

McCollum’s attorneys wrote that “Circle permitted this criminal use of its technology and services,” and added that “These losses would not have occurred, or would have been substantially reduced, had Circle taken timely action.” The complaint points to an instance about a week before the Drift breach when Circle froze 16 USDC wallets in connection with a sealed U.S. civil case, arguing that action shows the company had the technical capacity to freeze assets tied to the exploit.

The filing raises questions about the responsibilities of companies that issue fiat‑pegged tokens and operate cross‑chain infrastructure. The complaint asks whether the ability to intervene gives rise to a legal obligation to block or reverse transfers during live exploits and what standard would govern such intervention without a court order.

Circle did not immediately respond to requests for comment about the complaint. The filing requests monetary relief for investors and seeks to establish liability based on Circle’s handling of the transfers.

Lorenzo Valente, director of research for digital assets at ARK Invest, argued freezing funds without a legal order can lead to arbitrary decision‑making, asking why one malicious actor’s funds should be blocked while another’s are not. “Every future freeze is now a judgment call. Every non-freeze is a political statement,” he wrote, adding that reasonable people can disagree over how to weigh rule‑of‑law principles against immediate harm.

The case will proceed in the U.S. District Court for the District of Massachusetts.